Maria B Line
email: maria.b.line@item.ntnu.no

Nils Brede Moe
email: nils.b.moe@sintef.no

Understanding Collaborative Challenges in IT Security Preparedness Exercises

Keywords: Information Security, Incident Management, Preparedness Exercises, Training, Decision-making, Self-managing Teams

IT security preparedness exercises allow for practical collaborative training, which in turn leads to improved response capabilities to information security incidents for an organization. However, such exercises are not commonly performed in the electric power industry. We have observed a tabletop exercise as performed by three organizations with the aim of understanding challenges of performing such exercises. We argue that challenges met during exercises could affect the response process during a real incident as well, and by improving the exercises the response capabilities would be strengthened accordingly. We found that the response team must be carefully selected to include the right competences and all parties that would be involved in a real incident response process, such as technical, managerial, and business responsible. Further, the main goal of the exercise needs to be well understood among the whole team and the facilitator needs to ensure a certain time pressure to increase the value of the exercise, and both the exercise and existing procedures need to be reviewed. Finally, there are many ways to conduct preparedness exercises. Therefore, organizations need to both optimize current exercise practices and experiment with new ones.

Introduction

Preparing for information security incident management requires training. Basic structures such as well documented procedures and clear definitions of roles and responsibilities need to be in place, but during an incident, there is no time to study documentation in order to figure out the most appropriate response strategies; involved personnel needs to be well trained and well experienced, and hence able to make the right decisions under pressure [START_REF] Hollnagel | The four cornerstones of resilience engineering[END_REF]. Wrong decisions may cause the incident to escalate and lead to severe consequences.

The electric power industry is currently implementing major technological changes in order to achieve smart grids. These changes concern new technologies, higher connectivity and more integration, which increase the attack surface and the potential consequences of attacks [START_REF] Line | Why securing smart grids is not just a straightforward consultancy exercise[END_REF]. At the same time, current threat reports show that targeted attacks are on the rise, and critical infrastructures are attractive targets [3]. However, recent studies of the electric power industry show that preparedness exercises for IT security incidents are not commonly performed [START_REF] Line | Information security incident management: Planning for failure[END_REF][START_REF] Line | Targeted Attacks against Industrial Control Systems: Is the Power Industry Prepared?[END_REF] though guidelines exist for how to plan and perform such exercises [START_REF] Grance | NIST SP 800-84: Guide to Test, Training and Exercise Programs for IT Plans and Capabilities[END_REF][START_REF] Nve | Øvelser: En veiledning i planlegging og gjennomføring av øvelser i NVE[END_REF]. Reasons for not performing such exercises seem to relate to their perception of the probability of being attacked and their understanding of potential threats and consequences, and that more pressing tasks receive higher priority. Still, personnel from both the IT staff and the industrial control staff express confidence in their organization's incident response capabilities.

Motivated by the importance of collaborative training for responding to information security incidents, and the evident problem of adopting such training, the following research question is defined for our study:

What are the challenges of performing tabletop exercises for IT security incidents?

We will discuss how these challenges might affect the incident management process during a real-life incident and provide recommendations for how to reduce these challenges in the setting of an exercise, as that should positively affect a real-life incident management process as well.

The paper is structured as follows. Related work on preparedness exercises are described in Section 2. The research method and our case context are presented in Section 3, while Section 4 sums up the observations made during the case study. Challenges are discussed in Section 5 along with recommendations for preparedness exercises, and Section 6 concludes the paper.

Background

The purpose of an emergency preparedness exercise is to strengthen the response capabilities of an organization by training personnel in responding to situations that deviate from normal operations. A certain baseline of written plans and procedures should be present. However, during an emergency there is a need for a more dynamic process that requires coordination and improvisation, and where exceptions and violations are managed, and experienced incident handlers are valued. Relying on predefined documentation is what Hale and Borys refer to as Model 1 in the use of safety rules and procedures [START_REF] Hale | Working to rule, or working safely? Part 1: A state of the art review[END_REF], while allowing for rules to be emerged from practical experience is referred to as Model 2. Exercises are a way of developing Model 2. In the following we elaborate on tabletop exercises specifically, and coordination and improvisation in the incident response process.

Tabletop exercises

Tabletop exercises prepare personnel for responding to an emergency situation. They allow for discussions of roles, responsibilities, procedures, coordination, and decision-making, and are a reasonably cost-efficient way of reviewing and learning documented plans and procedures for incident response. Tabletop exercises are usually performed in a classroom without the use of any specific equipment. A facilitator presents a scenario and initiates the discussion. According to the National Institute of Standards and Technology (NIST), a tabletop exercise should consist of the following four phases; Design the event by identifying objectives and participants, Develop the scenario and guides for the facilitator and the participants, Conduct the exercise, and Evaluate by debriefing and identifying lessons learned [START_REF] Grance | NIST SP 800-84: Guide to Test, Training and Exercise Programs for IT Plans and Capabilities[END_REF]. As a training method it suffers from the weakness that it does not provide practical demonstrations of the effects of an incident or the emergency management's true response capabilities [START_REF]FEMA: IS 139 Exercise Design -Unit 5: The Tabletop Exercise[END_REF].

In his study of preparedness exercises initiated by the Norwegian Water and Energy Directorate (NVE), Gåsland [START_REF] Gåsland | Gjør øvelse mester? Om laeringsfaktorer i beredskapsøvelser initiert av NVE[END_REF] found that there is a positive attitude for participating in exercises and an understanding that collaboration is important in problem-solving processes. He still found that exercises compete with daily tasks for prioritization, and he considered it to be an obstacle to learning if exercises are not used as a means of making improvements afterwards. Further, he emphasized the importance of making exercises as realistic as possible. However, creating realistic scenarios is challenging [START_REF] Hove | Information security incident management: Identified practice in large organizations[END_REF], and even though a scenario is successfully responded to in an exercise, it does not give any guarantees that a real emergency situation will be successfully responded to [START_REF] Rykkja | Kap. 8: Øvelser som kriseforebygging[END_REF].

Coordination in preparedness exercises

Coordination of work and making collaborative decisions are important aspects of the incident response process and hence also of preparedness exercises. Responding to an IT security incident usually implies personnel from different parts of an organization collaborating on solving complex problems. "Coordination is management of interdependencies between activities" [START_REF] Malone | The Interdisciplinary Study of Coordination[END_REF] and coordination mechanisms are the organizational arrangements, which allow individuals to realize a collective performance [START_REF] Okhuysen | Coordination in Organizations: An Integrative Perspective[END_REF]. Interdependencies include sharing of resources, synchronization of activities, and prerequisite activities. Coordination challenges in incident response are functions of the complexity, such as processes and technology.

Further, responding to an IT security incident is creative work, as there might not be one correct solution and a number of both uncertainties and interdependencies need to be taken into account. In creative work progress towards completion can be difficult to estimate [START_REF] Kraut | Coordination in Software Development[END_REF] because interdependencies between different pieces of work may be uncertain or challenging to identify. This makes it difficult to know who should be involved in the work, and whether there is a correct order in which parties should complete their own specialized work [START_REF] Okhuysen | Coordination in Organizations: An Integrative Perspective[END_REF]. Further, in creative work it is essential to improve the knowledge transactions between team members. This is captured in a transactive memory system (TMS), a shared cognitive system for encoding, storing and retrieving knowledge between members of a group [START_REF] Lewis | Transactive Memory Systems: Current Issues and Future Research Directions[END_REF]. TMS can be understood as a shared understanding of who knows what and also on the degree to which individual knowledge sets are differentiated.

Coordination can be either predefined or situated [START_REF] Lundberg | Understanding Complex Coordination Processes in Health Care[END_REF]. Predefined coordination takes place prior to the situation being coordinated and can be understood as what Hale and Borys refer to as Model 1 [START_REF] Hale | Working to rule, or working safely? Part 1: A state of the art review[END_REF] and an incident response scheme as described by ISO/IEC 27035 -Information security incident management [18]. It typically consists of establishing written or unwritten rules, routines, procedures, roles, and schedules. Situated coordination, on the other hand, occurs when a situation is unknown and/or unanticipated, such as when an IT security incident strikes, and can be understood as Model 2 [START_REF] Hale | Working to rule, or working safely? Part 1: A state of the art review[END_REF]. Those involved in the situation do not know in advance how they should contribute. They lack knowledge of what to achieve, who does what, how the work can be divided, in what sequence sub-activities should be done, when to act, etc. Consequently, they have to improvise and coordinate their efforts ad hoc. In most collaborative efforts there is a mix of predefined and situated coordination. Involved actors may for instance already know the goal, but not who performs what, or they may know who does what but not when to do it. To compensate for lacking predefined knowledge of how the actual unfolding of activities in an exercise will be, the participants must update themselves on the status of the situation.

To handle a crisis, not only does the team need to coordinate their work; they also need to take decisions together and be responsible for managing and monitoring their own processes and executing tasks, i.e they need to be able to self-manage [START_REF] Hackman | The psychology of self-management in organizations[END_REF].

Method

Since the goal of this research was to explore and provide insight into challenges experienced during IT security preparedness exercises, it was important to study such exercises in practice. We designed a holistic multiple case study [START_REF] Yin | Case Study Research -Design and Methods[END_REF] of three IT security preparedness exercises in three different organizations. According to Yin, case studies are the preferred research strategy when a "question is being asked about a contemporary set of events over which the investigator has little or no control" [ibid p. 9]. In the following, we present the scenario used, the organizations studied, and how data collection and analysis were performed.

Scenario

One scenario recently recommended by the authorities3 was used by all organizations in our study. This scenario describes an information security incident that escalates through five phases:

1. Abnormally large amounts of data is sent to external recipients. 2. Two weeks later, the SCADA supplier wants to install a patch. The contact is made in a different way than what is regulated in the service agreement.

3. Three months after the first event, one area suffers from power outage. The monitoring systems do not display any alarms. 4. Customers start calling as more areas suffer from power outage. The monitoring systems do still not display any alarms. 5. Mobile communications and Internet connections are down.

The participants had 20 minutes to discuss each phase before they were given information about the next. For each phase the participants had to describe how they would interpret the events and which actions they would take.

Case Context

The three organizations in our study are Norwegian Distribution System Operators (DSOs) and they are among the ten largest DSOs in Norway. For organizations A and B, this was their first execution of such a collaborative exercise for IT security. Organization C had performed a similar exercise once before, and the Emergency Management Team performs preparedness exercises regularly for a variety of incident types. In the following, we present the organizations and how each of them set up their exercise, as well as all participants and their number of years of experience in the organization.

Organization A. Three groups of personnel were represented in this exercise: IT operations, industrial control systems, and network infrastructure. Nine participants were present, including the Preparedness Coordinator4 , a representative from external supplier of SCADA systems, and the facilitator, cf. Table 1. Organization B. Fourteen participants represented three different areas of expertise: IT, control systems, and control room operations. They were divided into three groups for the exercise, and there was one observer in each group, cf. Table 2. "GO" indicates who was the group observer. The intention was to have all three areas of expertise represented in each group, but last minute changes due to sudden business-related events caused group 1 to not have anyone from control systems. The HSE/Quality/Preparedness Coordinator, who has more than 20 years of experience, visited all three groups and is therefore not listed in the table in one specific group. Organization C. Twelve employees took part in the exercise, cf. Table 3. Five belonged to the Emergency Management Team and were called for when their presence was needed. One person facilitated the exercise in close collaboration with the IT security coordinator.

Data collection and analysis

The first author contributed to the planning of all the tabletop exercises. Before the scenario was presented to the participants, they were asked about their expectations for the exercise. A retrospective was facilitated after the exercise, where all participants reflected upon what worked well and what could have been done differently. Their expectations from beforehand were discussed; whether they were fulfilled and why/why not.

For the analysis, we described the tabletop exercises and evaluations from each organization to achieve an understanding of what was going on during the exercises. Then we categorized interesting expressions and observations, before we compared findings between the organizations.

Results

The three organizations carried out the preparedness exercises according to generally recommended NIST practices. Plans and goals of the exercise were established in advance, and they all discussed the five phases of the scenario. While the three organizations used the same scenario and main agenda for the exercise, they all had diversity in goals and the number and types of participants. Our observations are hereby presented, as characterized by the following descriptions:

1. Knowledge exchange and process improvement (org. A) 2. Cross-functional self-managing groups (org. B) 3. Involvement of Emergency Management Team (org. C)

Knowledge exchange and process improvement

In organization A the IT security coordinator for control systems planned and facilitated the exercise. He presented his goals for the exercise in the beginning: knowledge exchange across organizational boundaries, obtaining a common understanding of what is technically possible in todays' systems, identifying technical and organizational improvements, and ideas for future exercises. participants were seated around one big table. The scenario was already known to two of the participants; the fiber networks manager and the emergency preparedness coordinator; as they had participated in this exact same exercise the week before in a different context. This was the only organization that included one participant from their supplier.

A few participants dominated throughout the whole discussion and nobody seemed to take charge of the group as a chair person responsible for involving all participants and achieving consensus in the group. For the first three phases the IT security coordinator and the fiber networks manager appeared to be quite sure of what would be the right choices of action. Still, they were open about lacking knowledge of systems outside their own domain and asked questions in order to get the whole picture. The facilitator later commented that he had expected these two participants to dominate because of their roles, competences, and personality. He added that in a real emergency situation, only four of the participants would be involved in the crisis management group: the two most dominant participants, the control systems manager, and himself.

The participants were satisfied with this exercise being performed, as they see this as an important scenario for preparedness exercises and as lacks were revealed that they need to work on to improve their own response capabilities. Furthermore, they approved of the initiative of making different parts of the organization meet for an IT security exercise. However, some participants felt that the discussion was a bit out of control, as they did not manage to keep the focus on solving the actual problems presented in the scenario. They missed a person facilitating the discussion. The facilitator, on the other hand, was satisfied with the discussion, as he saw it as valuable knowledge exchange, which was one of his main goals. At the same time, some participants would have liked to have more time for discussions. Furthermore, some perceived the last phase of the scenario to be unrealistic and unlikely.

One important insight obtained was that they would not be able to relate the event in the third phase to the two events that occurred three months earlier.

Their main priority is usually to get the systems back to normal operations, while understanding why the incident occurred typically receives less focus, if any. A number of improvements were identified, regarding both technical and organizational aspects, in order to strengthen the response capabilities for information security incidents affecting complex IT and control systems.

Cross-functional self-managing groups

The exercise in organization B prepared by a group of three managers: of IT security, control systems, and the control room. The former had participated in a similar exercise before. The goal of the exercise was to practice collaboration between the departments of industrial control and IT systems. The subgoals were to get to know persons, tasks, and responsibilities across the two involved departments and identify improvements to existing procedures for emergency preparedness and information security in general. The three managers acted as observers; one for each group of participants. They were responsible for presenting the scenario, making sure the group made decisions for each phase of the scenario, and assisting the group in keeping the discussion going if necessary. Each group was seated around one table in three different meeting rooms.

The group observers reported that in general, the group discussions were good and nobody seemed to dominate. In group 3 the control room manager took to some extent on the role as a chair person for the group; the group observer perceived this as natural based on his role in the organization. This group observer further stated that the participants appeared curious on each others' competences and responsibilities as they lacked this insight in order to get the big picture. The observer in group 1 would like to see more involvement from the management level in preparedness exercises.

Each group was intended to be self-managing, with as little intervention from the group observers as possible. Reflections from the group observers indicated that it was difficult to keep quiet, as they wanted to contribute. This was particularly challenging for the observer in group 1, as this group suffered from the lack of control systems personnel, and he was the only one with this competence. He still chose to remain fairly passive. All group observers reported that they did not need to intervene in order for the discussions to keep going. They did not need to push their groups into making decisions either, as the groups were focused on solving the problems as described in the scenario. While all groups made several decisions on what would be appropriate actions for each phase of the scenario, they did not present clear solutions to all sub-problems.

There was some criticism to the scenario description: "It is stated here that we reinstalled (...), but we would never have done that because (...)". Some pointed out that the scenario was not realistic because of how their systems are integrated, while others found the scenario to be quite realistic.

The evaluation showed that the participants were overall satisfied with the exercise. They appreciated the opportunity to meet and get to know colleagues from other parts of the organization and to get insight into their areas of responsibilities and knowledge. The participants would have liked to have more time than 20 minutes for discussions for some of the phases. Furthermore, they lacked the opportunity to hear how the other groups had solved the problems. A separate meeting for this was arranged a couple of weeks later. One participant suggested they use the existing preparedness plans and procedures actively during such an exercise. The group observers found the thorough evaluation process to be very valuable, and they saw it as an advantage that it was lead by an external (one researcher) as it made the participants put extra effort into contributing.

Involvement of Emergency Management Team

In organization C the exercise was planned by the IT security coordinator and a facilitator from the communications department. The goal of the exercise was awareness raising and practice in responding to IT security incidents that occur in the control systems. The participants were seated around one big table. Five representatives from the Emergency Management Team were present during the introduction. Three of them left the room when the scenario was presented, while two chose to stay as passive observers. The intention was that the complete Emergency Management Team should be called for at a later phase of the scenario, when the seriousness of the incident required them to be involved, in order to resemble a realistic situation. They were called for twice.

When the first phase of the scenario was presented, the IT operation manager quickly claimed ownership of the incident. He said that he would be the one to get the first alert, and that he would be the one to initiate analyses and reporting to other stakeholders in the organization. One issue that was thoroughly discussed, was the reporting from IT to the control room: when would that be done, if at all; is this relevant information for the control room staff; and is this reporting line documented. This was identified as a lack in the documented procedures when one participant checked these during the discussion. The group still knew who to contact. Another issue that received a lot of attention, was the question of shutting down the control systems. The IT operation manager would recommend this at the stage where the control room supplier calls and wants to install a security patch in the control systems (phase two), as he was worried about the malware infections spreading further into the systems. The control system manager on the other hand claimed that shutting down the control systems has extensive financial consequences for the operations, as manual operations are expensive. The Emergency Management Team decided to shut down the control systems in the fourth phase of the scenario.

During the evaluation it was agreed that such an incident would pose a great challenge for the organization. They still concluded that the situation was resolved satisfactorily in this exercise, and that they would be able to maintain power production and distribution by manually operating power stations. The facilitators felt that relevant assessments and decisions were made, and that the Emergency Management Team was involved at the right points in time. The Emergency Management Team contributed with thorough analyses and unambiguous decisions.

Discussion

We have described a tabletop exercise as performed in three organizations. While they all relied on the same scenario, they organized the exercise differently. In the following we discuss the importance of preparedness exercises, along with our results in the light of our research question: What are the challenges of performing tabletop exercises for IT security incidents? Then we discuss how observed challenges could affect a real-life incident response process. Finally, we provide recommendations for how to succeed with preparedness exercises.

Our study confirmed the importance of conducting preparedness exercises. In organization A they realized that in a real situation they would most probably not be able to link the third phase to the first two, i. e. events that occur three months apart. By training they became aware that such links exist. Further, the participants in organization B were not sufficiently aware of each others' needs for information. They realized how the information flow could be improved. In two of the organizations in our study, A and B, the participants had different views on whether the scenario was realistic or not. This difference shows a need for developing a common perception of possible threats and potential consequences, which can be partly achieved by performing exercises.

A single best practice on organizing tabletop exercises does probably not exist. However, we found a number of challenges that need to be understood in order to succeed with such training.

Having one goal only. For a team to have good performance and to be able to effectively solve a complex problem, they need shared understanding of the team goals [START_REF] Moe | A teamwork model for understanding an agile team: A case study of a scrum project[END_REF]. Having several goals for the exercise might lead to the individual members heading towards different goals. In organization A the team focused on solving the given problem while the facilitator was just as focused on knowledge sharing and fruitful discussions. As a consequence they had problems staying focused during the exercise. The main goal of an exercise should be to solve the problem, while additional goals may rather be aimed for during the evaluation afterwards, as was done in organization B.

Recommendation: Define only one main goal for the preparedness exercise.

Enabling self-management and growing team knowledge. For a team to solve a crisis and make good decisions it needs to be able to self-manage. Members of self-managing teams share decision authority jointly, rather than having a centralized decision structure where one person makes all the decisions, or a decentralized decision structure where team members make independent decisions. Organization A had problems self-managing as two persons made most of the decisions. It was later concluded that only a few of the team members would participate in a real situation. The others should have been present as observers to distinguish between who are part of the team and who are not. Enabling self-management further requires the group to have the necessary competence; otherwise the group will be training for solving the problem without having the necessary competence available. However, because handling incidents is creative work, it might be challenging to identify everyone that should be present in the training up front. One of the teams in organization B clearly suffered from the lack of competence, and both organizations B and C lacked personnel from their external suppliers. The training outcome would have been better with the right personnel present.

In addition to the right competence, a shared understanding of who knows what is needed to solve a crisis effectively [START_REF] Lewis | Transactive Memory Systems: Current Issues and Future Research Directions[END_REF]. We found that in most teams people did not have a good overview of what the others knew, however, the team members became more aware of each others' knowledge during the exercise.

Recommendation: Ensure the presence of all required competence in the team, including personnel from external suppliers. Make it explicit who are part of the team and who are observers. Include a facilitator to support the team in making joint decisions and conduct exercises frequently to develop a shared understanding of who knows what.

Availability of personnel. Business runs continuously and might require sudden and unforeseen actions, which in turn might cause personnel to cancel their presence in the exercise. This will affect the group composition as happened in organization B, where last minute changes led to the lack of one type of competence in one of the groups. Further, members of management groups tend to have little time for exercises, but their presence is needed to have realism to the exercise. Limiting the time spent on exercises would most likely make it easier for key personnel to participate. All organizations experience turnover. Hence, sudden absence of critical competence might be experienced during a real-life incident as well.

Recommendation: Perform preparedness exercises frequently to make sure that all personnel receive training regularly. Limit the time spent on each exercise to make it easier for key personnel to participate. Time management. Having 20 minutes for discussing each phase was perceived as too short for some, while sufficient for others, depending on both the participants and the complexity of the given problems. Creating a time-pressure for making quick decisions was understood as making the exercise more realistic. Still, according to FEMA [START_REF]FEMA: IS 139 Exercise Design -Unit 5: The Tabletop Exercise[END_REF] it is wise to take the time to resolve problems. A facilitator needs to balance the amount of time spent on the different phases based on the progress and how well the team performs. Further, making time for thorough reflections after the exercise is important to improve the benefits of the exercise, as was also recommended by NIST [START_REF] Grance | NIST SP 800-84: Guide to Test, Training and Exercise Programs for IT Plans and Capabilities[END_REF]. Both organizations A and B spent 60-70 minutes on such reflections and stated that one large benefit was that of having an external facilitator for this, as the participants clearly put more effort into contributing than they would usually do during internal evaluations. A similar evaluation was planned for organization C, but they ran out of time and did not prioritize a thorough evaluation after the exercise. A short around-the-table discussion was performed.

Recommendation: Ensure time pressure by limiting the time for problemsolving in the exercise. Allow for thorough reflections in a plenary session right after the exercise is completed. If there is more than one group, add time for reflection within each group as well, before the plenary session.

Use of existing documentation. None of the teams actively consulted written plans and procedures during the exercise. Such plans were made available to the team in organization C only. Although documentation needs to be in place, situated coordination is more important because the scenarios in the exercise are unknown. An organization therefore needs to rely on the individuals and their knowledge when handling a crisis. In organization C, a lack in the reporting procedures was identified, but the participants still knew who to contact and when. It was stated that in an emergency situation there is no time for consulting documentation. Exercises contribute to develop practical knowledge and the knowledge of who knows what, which is essential to make good decisions when handling an incident. Still, documentation would be available during a real situation, therefore it should also be available during an exercise. One of the main goals with a tabletop exercise is to review plans and procedures [START_REF]FEMA: IS 139 Exercise Design -Unit 5: The Tabletop Exercise[END_REF], and this should be performed shortly after the exercise.

Recommendation: Make existing written documentation available during the preparedness exercise and review the documentation in retrospective if needed. If the available documentation is not consulted, discuss why.

Involvement of business management. It is essential to involve those with the authority to make decisions influencing business operations. IT security involves more than IT personnel, as an incident might have severe consequences for both the organization, its customers, and society at large. In an emergency situation the goal from a business perspective is usually to maintain normal operations as continuously as possible. However, there are different strategies that may be used for this: to resolve the incident with as little disturbances to the operations as possible, to understand why the incident occurred, or to make sure that the incident will not repeat itself. These different strategies require slightly different approaches and priorities, and it is therefore crucial that the incident responders have a common understanding of the overall preferred strategy.

Organization C seemed to succeed with their model where the team called for the Emergency Management Team when severity of the incident required them to. In organization C the IT personnel wanted to shut down the control systems quite early, due to their fear of malware infections; the control room manager wanted to wait, due to high costs of manual operations. These costs were compared to the consequences of an uncontrolled breakdown. We found that priorities among different parts of the organization vary, which supports the need for collaborative exercises and practicing joint decision-making, at the same time as different authority levels come into play.

Recommendation: Include all personnel that will play a role during a real-life incident, including both technical personnel and business representatives.

Concluding remarks and future research

For industrial control organizations to withstand and/or successfully respond to attacks, personnel from different parts of the organization need to collaborate: IT, control systems, control room, networks/infrastructure, and business representatives. These groups of personnel do not have a tradition for collaborating with each other, as industrial control systems used to be isolated from administrative IT systems. A holistic view of the incident response process is needed so that the whole organization is included in training, as it would be during a real emergency situation.

There are many ways to conduct preparedness exercises. Therefore organizations need to both optimize current exercise practices and experiment with new ones. Regardless of how the exercises are conducted, there are a number of challenges to be aware of, as identified in our study. Functional exercises should be performed as a supplement to tabletop exercises in order to improve the operational capabilities as well.

We studied organizations doing such exercises for the first time. There is therefore a need to study which challenges are met by organizations that are more mature when it comes to performing preparedness exercises for IT security incidents. Such a study should also investigate what good practices these organizations are performing in their exercises. Further, challenges met during real-life incident response processes should be investigated, in order to make preparedness exercises even more useful.

Table 1 .

 1 Participants in organization A

	Role	Exp.
	IT production manager	5
	IT security coordinator	25
	Fiber networks manager	>20
	Senior engineer, fiber networks	5
	Control systems manager	20
	Special advisor, remote control units	>30
	Service engineer, supplier of control systems	>30
	Emergency preparedness coordinator	>30
	IT security coordinator for control systems (facilitator) 28

Table 2 .

 2 Participants in organization B

	Group 1			Group 2		Group 3
	Role	Exp. Role			Exp. Role	Exp.
	Control operations eng.	10	Control operations eng.	25	Control systems engineer 6
	IT infrastructures engr.	9	Control operations eng.	>20 Control room manager	8
	IT operations engineer	1	IT operations engineer	29	IT operations engineer	>15
	IT manager	4	IT operations engineer	8	IT operations engineer	8
	Control sys. manager (GO) 1	IT business sys. manager >20 IT security manager (GO) 12
			IT consultant		1
			Control	ops.	manager	>10
			(GO)

Table 3 .

 3 Participants in organization C

	Technical personnel		Emergency Management Team
	Role	Exp. Role	Exp.
	Manager, Control room DSO	5	Main corporation, IT manager	3
	Deputy manager, Control room DSO	34	Power production, CEO	19
	Manager, Control systems	36	DSO Technical manager	28
	IT operation manager	4	Emergency preparedness coordinator	30
	IT network security engineer	6	DSO Manager, emerg. prep. manager	5
	Marketing, Broadband, Tech. manager 8

Norwegian Water Resources and Energy Directorate (NVE)

All DSOs are required to have this role assigned to someone.

Acknowledgments.

The authors would like to thank the three DSOs that participated in this study, and Senior Research Scientist Martin G. Jaatun, SINTEF, and Professor Poul E. Heegaard, NTNU, for providing valuable feedback. This work was funded by the Norwegian Research Council through the DeVID project, grant no 217528, and by the Norwegian University of Science and Technology through the project Smart Grids as a Critical Infrastructure.


Teodor Sommestad
email: teodor.sommestad@foi.se

Social groupings and information security obedience within organizations

Keywords: information security culture, theory of planned behavior, information security behavior, compliance, obedience

Individuals' compliance with information security policies is important for the overall security of organizations. It has been suggested that obedience cultures exist in organizations and that social processes and structures play a role for the compliance intentions and compliance behavior of individuals. This paper investigates if individuals' compliance intention is more homogenous within social groups in the workplace than they are within the workplace overall workplace and the effect these groups have are in line with the theory of planned behavior. The results show that a considerable portion of variance in information security policy compliance intentions is explained by the respondents' organizational department (15%), professional knowledge area (17%), and the same lunch room (18%). While sizeable and significant effects can be found on intentions the effects on attitudes, norm and perceived behavior control are less clear. The only statistically significant (p<0.05) effect is from department on attitudes and perceived norm, each with 6% explained variance. This suggests that the theory of planned behavior fails to account for factors tied to these types of social groups.

Introduction

Information security behavior is important for the overall security of organizations. It is also a lively research area and a considerable number of studies have been performed to identify factors that influence individuals' information security behavior. In a recently published review we identified 29 quantitative empirical studies published before March 2012 testing antecedents of security policy compliance attitudes, intentions and behavior [START_REF] Sommestad | Variables influencing information security policy compliance: a systematic review of quantitative studies[END_REF]. Meanwhile, social aspects related to information security have gained increased attention in recent years, often discussed as information security culture. Theory suggests that if managers can predict or control the information security culture(s) of their organization they can manage the information security of their organization more efficiently [START_REF] Veiga | A framework and assessment instrument for information security culture[END_REF]. For instance, [START_REF] Lacey | Understanding and transforming organizational security culture[END_REF] suggests that educational efforts should be adapted to cultural differences. Information security culture is a concept that is used and interpreted in many different ways. However, there is a wide agreement that it is a group phenomenon where something is shared in the group and that social context and communication play a role. For instance, Hofstede [START_REF] Hofstede | National cultures, organizational cultures, and the role of management[END_REF] states that "cultures of work organizations are acquired through socialization at the work place." It follows that the frequency and the way people interact ought to determine the culture they share. However, as will be shown below, there is little known about how social processes form individuals' information security compliance.

In this paper the relationship between social groups' and individuals' views of information security policy compliance is investigated. A questionnaire-based survey within a governmental research institute in Sweden is used to assess individuals' views on information security policy compliance and the social groups they belong. Individuals' views are measured as prescribed by the theory of planned behavior [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF]. This theory states that the effect of social factors (like culture) on intentions to perform a behavior is fully mediated by attitude, perceived norms and perceived behavior control associated with the behavior [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF]. The effect of social group membership on information security culture is measured by comparing the responses in the organization as a whole to the responses within three types of groups within the organization namely groups based on: organizational department, professional knowledge area, and lunch room.

The outline of this paper is as follows. Section 2 describes the theoretical background and presents the hypotheses that are addressed. Section 3 details the method. In section 4 the results are presented and in section 5 implications are discussed. In section 6 conclusions are drawn.

Theory and research questions

This section will introduce some of the more central ideas needed to understand the present focus and scope of the present study. The theory of planned behavior (TPB) is described in section 2.1 and a broad description of information security culture is given in 2.2. The hypotheses derived from this are described in section 2.3.

The theory of planned behavior

The TPB [START_REF] Ajzen | The theory of planned behavior[END_REF] and its predecessor, the theory of reasoned action [START_REF] Fishbein | A theory of reasoned action: Some applications and implications[END_REF], offer an established framework for predicting behavioral intentions and actual behavior. According to the theory, illustrated in Figure 1, behavior is influenced by people's intentions and actual behavior control, where actual behavior control moderates the effect of intentions. Most applications use perceived behavior control as a proxy because of the difficulties associated with measuring actual behavior control, as advocated by [START_REF] Ajzen | The theory of planned behavior[END_REF].

Additionally, the moderating role of perceived behavior control has been difficult to establish empirically, and many models include it side-by-side with intentions in a simpler additive linear model [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF].

Fig. 1.

The theory of planned behavior and culture, adapted from [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF].

The TPB further states that intentions are influenced by attitude, perceived norms, and perceived behavior control. Their influences are assumed to be linear, i.e., the effects can be modeled using additive models. Although the theory claims that these three constructs are sufficient to explain the intentions concerning a behavior in question, there is no universal ordering of their importance. On the contrary, the relative importance of the constructs differs among populations and behaviors. For instance, for behaviors over which people feel they have almost full control, the variable perceived behavior control is of little value because it is equal for all respondents [START_REF] Ajzen | The theory of planned behavior[END_REF] .

A recent meta-analysis of observational questionnaire based studies of information security policy compliance behavior found the following sample-weighted correlation coefficients between variables: attitude-intention 0.48, perceived norm-intention 0.52, perceived behavior control-intention 0.45, intention-behavior 0.83 and actual behavior control-behavior 0.35 [START_REF] Sommestad | A review of the theory of planned behaviour in the context of information security policy compliance[END_REF]. Approximately 0.4 of the variance in security policy compliance intentions is explained by the variables in the theory, leaving approximately 0.6 of the variance in intentions to be explained by measurement error and missing variables.

As Figure 1 shows, the originators of the theory of planned behavior explicitly list culture as a primary antecedent to the constructs that the theory says influence behavior [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF]. The study presented in this paper focuses on this link between culture and information security compliance. More precisely, this study aims to investigate if social groups at the work place influence the variables of the theory of planned behavior in this way.

Information security culture

Research on information security culture rests heavily on the more general concept of organizational culture and the theories developed related to culture in other fields. However, this is of little help when it comes to agreeing on a definition for the conceptalready in 1998 a review found 54 different definitions of the concept of organizational culture in the literature [START_REF] Verbeke | Exploring the Conceptual Expansion within the Field of Organizational Behaviour: Organizational Climate and Organizational Culture[END_REF].

Research on information security culture often focuses on policy compliance. For example, in [START_REF] Thomson | Information security obedience: a definition[END_REF] it is argued that information security obedience (i.e., compliance with policies) binds together information security, corporate governance and corporate culture and in [START_REF] Furnell | From culture to disobedience: Recognising the varying user acceptance of IT security[END_REF] "culture" is described as the ideal state of "compliance. The most frequently cited their theoretical frameworks in r research on information security culture [START_REF] Karlsson | Information security culture: State-of-the-art review between 2000 and[END_REF] are those of Edgar Schein and Geert Hofstede. Schein's framework is a three-tiered model that explains organizational culture on the levels of shared basic assumptions, espoused values and artifacts/behaviors [START_REF] Schein | Coming to a new awareness of organizational culture[END_REF]. Schein recently argued for a move away from discussions about abstract definitions and more concrete operationalizations instead, e.g., through measurement instruments [START_REF] Schein | Preface[END_REF]. Hofstede, known to have developed the first empirical model of dimensions of national cultures, provides a succinct definition of culture as "the collective programming of the mind that distinguishes the members of one group or category of people from another" [START_REF] Hofstede | Dimensionalizing cultures: The Hofstede model in context[END_REF]. In Hofstede's definition, and in Schein's model, culture can be tied to various groupings of humans, e.g., nations, cities, organizations, work groups, occupations, professions, and so on. Four levels of analysis for perception in organizational culture research are distinguished in [START_REF] Yammarino | Multilevel Issues in Organizational Culture and Climate Research[END_REF]: 1) individuals, 2) workgroups or teams that interact on a face to face or virtual basis, 3) larger groups like whole organizations and 4) societies or countries. The current study is focused on level two and aims at examining the notion that social groupings in the workplace form individuals' information security policy compliance. There is little knowledge on the relative importance of different social groupings on this level, or what the relative importance depends on. Previous research on information security culture has primarily addressed the concept on an organizational level (e.g., [START_REF] Malcolmson | What is security culture? Does it differ in content from general organisational culture? 43rd[END_REF] [2] [START_REF] Schlienger | Information security culture-from analysis to change[END_REF]), surveyed how individuals perceive the culture (e.g., [START_REF] Hu | Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture*[END_REF][20] [START_REF] Mccoy | An Investigation of the Impact of Corporate Culture on Employee Information Systems Security Behaviour[END_REF]) or group norms (e.g., [START_REF] Herath | Protection motivation and deterrence: A framework for security policy compliance in organisations[END_REF]), and occasionally on a national level (e.g., [START_REF] Furnell | End-user security culture: A lesson that will never be learnt?[END_REF]). Furthermore, there is also little known about the relative importance of different social groups for attitudes and values related to information security, such attitudes and values to safety. For example, no quantitative measurements on the relation between different groups and safety views can be found in the following reviews of safety climate and safety culture measurements [START_REF] Guldenmund | The use of questionnaires in safety culture researchan evaluation[END_REF][25] [START_REF] O'connor | Measuring safety climate in aviation: A review and recommendations for the future[END_REF].

To summarize, information security culture is (like culture in general) difficult to define and measure, it is relatively often coupled to policy compliance, and there is little research on information security culture between the levels of whole organizations and single individuals. The present study does not attempt to define the concept of culture, but use social groups within an organization as a proxy for the culture(s) individuals belong to and use these as proxies for the culture an individual belongs to. This paper follows the definition of Turner [START_REF] Turner | Towards a cognitive redefinition of the social group[END_REF] and consider a social group to be two or more individuals who share a common social identification of themselves or two or more individuals who perceive themselves to be members of the same social category.

2.3

Hypotheses

Three main hypotheses together with nine sub-hypotheses are addressed in this study. These hypotheses concern how organizational departments, professional knowledge areas, and lunch room explain variation in constructs covered by the theory of planned behavior. They are discussed and presented below.

In most organizations, managers try to set goals, measure the achievement of goals and incentivize their staff through different types of social interactions (e.g., meetings, courses and documents). When it comes to information security, it can be expected that middle management plays the important role of implementing information systems strategies [START_REF] Leidner | Middle Management and Information Systems Strategy: The Role of Awareness and Involvement[END_REF] and their behavior is believed to be vital to cultural change because of the feedback they give to employees [START_REF] Niekerk | An holistic framework for the fostering of an information security sub-culture in organizations[END_REF]. In our study's organization, the management structure follows, as in many other organizations, the organizational structure and projects are heavily associated with this structure although they are not bound by it. Thus, the organizational department a person belongs to ought to shape its views on information security policies. The following hypotheses are therefore posed.

H1: Intentions to comply with information security policies are more homogenous within organizational department than within the organization as a whole.

H1.1: Attitudes to compliance with information security policies are more homogenous within organizational department than within the organization as a whole.

H1.2: Perceived norms with respect to compliance with information security policies are more homogenous within organizational department than within the organization as a whole.

H1.3: Perceived behavior control over compliance with information security policies is more homogenous within organizational department than within the organization as a whole.

In the studied organization eleven knowledge areas are defined by management. The knowledge area an individual is part of can also be expected to influence the culture an individual is a part of for several reasons. First, a professional knowledge area can be associated with certain codes of ethics, symbols, role models and professional goals. An example is the Hippocratic Oath sworn by those who practice medicine. Second, the professional knowledge area an individual works within often coincides with a particular type of schooling and knowledge. For instance, an individual who works with the secretive domain of electronic warfare can be expected to treat restrictions on electromagnetic leakage from information technology with more care than a person unaware of the risks associated with this. Third, it could be expected that individuals end up in social interactions with peers in the same knowledge area more often than they do with people from a randomly selected (other) knowledge area. In the studied organization most projects are within a particular knowledge area. Thus, the professional knowledge area ought to coincide with the workgroups and projects an individual belongs to. These factors lead to the following hypotheses.

H2: Intentions to comply with information security policies are more homogenous within professional knowledge areas than within the organization as a whole.

H2.1: Attitudes to compliance with information security policies is more homogenous within professional knowledge area than within the organization as a whole.

H2.2: Perceived norms with respect to compliance with information security policies are more homogenous within professional knowledge area than within the organization as a whole.

H2.3: Perceived behavior control over compliance with information security policies are more homogenous within professional knowledge area than within the organization as a whole.

Informal social interaction, like unstructured discussions and chattering, can be expected to play a role in the formation and conservation of information security culture. For instance, rumors, stories, gossip and opinions may be vetted during informal discussions and meetings might concern information security. To reliably group people according to how they socialize informally is of course difficult. However, in the present organization, located in Sweden, where "fika" (coffee breaks) is a social institution, and lunch rooms are places where informal meeting occur multiple times each day. Because of this, the lunch areas a person belong to captures much of an employee's informal social life and the following hypotheses are posed.

H3: Intentions to comply with information security policies are more homogenous within lunch areas than within the organization as a whole.

H3.1: Attitudes to compliance with information security policies are more homogenous within lunch areas than within the organization as a whole.

H3.2: Perceived norms with respect to compliance with information security policies are more homogenous within lunch areas than within the organization as a whole.

H3.3: Perceived behavior control over compliance with information security policies are more homogenous within lunch areas than within the organization as a whole.

None of the abovementioned hypotheses concerns actual behavior. The reason is not theoretical (culture is supposed to form behavior too); the reason is the costs and privacy issues associated with measuring actual policy compliance by monitoring employees behavior, especially without introducing observer bias.

Method and materials

This section presents the measurement instrument used in this study (section 3.1), the data collection procedure (section 3.2) and assessment of instrument validity in (section 3.3).

Measurement instrument

The questionnaire used contained an introductory section describing the purpose of the survey, a section explaining the question format, questions about the respondent's role and the social groups the respondent belonged to, questions operationalizing constructs in the theory of planned behavior, and other questions not directly related to the hypotheses addressed in this research.

Through a large number of applications, tests and reviews of the theory of planned behavior, a considerable amount of knowledge concerning how to best operationalize the theory in general has been accumulated. The parts of this measurement instrument associated with TPB was based on the example and template for direct scales given in [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF] and followed the guidelines it provides. Thus, both instrumental (e.g., bad-good) and experiential (e.g., necessary-unnecessary) attitudes were measured; items of perceived norms measured both injunctive norms (i.e., what people that are important think) and descriptive norms (i.e., what people that are important do); perceived behavior control covered both autonomy (e.g., if it is under my control) and capability factors (e.g., if it is easy to do). Intentions were measured as outright intention predictions of future behavior. As recommended by [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF] a questionnaire with open-ended questions was distributed in the target population to survey general beliefs related to the studied constructs before items were formulated. The answers were used as input in the formulation of the questionnaire items, e.g., to form bipolar scales for the attitude items. Three to four items were used for each TPB construct. Appendix contains a translation of the questions to English.

Questions regarding organizational department and knowledge area were formulated as multiple choice questions; lunch room was asked for in the form of a free text field with examples of the type of formulations to be used. All other questions in the questionnaire were associated with the behavior of complying with the information security policy and rules within the specific organization surveyed. These items were answered using a seven-point semantic differential scale. Their mean value is used to form the construct of interest, as proposed by [START_REF] Fishbein | Predicting and Changing Behavior: The Reasoned Action Approach[END_REF].

The layout and understandability of the instrument was reviewed iteratively by six employees within the surveyed organization before a final version was established. In this review process it was also verified that respondents understood the questions related to organizational department, knowledge area and lunch area.

Data collection procedure

This study surveyed perceptions of individuals within the Swedish Defence Research Agency in Sweden (also the organization the author belongs to). This organization is distributed over four geographical sites and has approximately 1000 employees, with a median age of 45 years and a relatively even age distribution. Approximately 35 percent hold a PhD. Approximately 800 work as researchers and 200 as work as managers or with internal services (e.g., information systems or facilities). The internal mail service distributed one printed copy of the survey to each employee during September 2013. A reminder was distributed electronically one week later. Surveys received within the first three months after the distribution were included in the analysis. A total of 311 questionnaires were returned within this time period. To ensure anonymity, respondents were encouraged to provide their department, knowledge area, and lunch area only if they wanted and felt comfortable doing so. Since many chose to only answer one or two of the three questions, a number of returned surveys could not be used for the test of research questions posed in this paper. In addition, it was deemed necessary to exclude respondents who belonged to groups of less than two persons to obtain a meaningful statistical measurement of the variance in the group. As a result of this filtering, only 176-178 questionnaires contained the responses necessary for the analysis of the 12 hypotheses.

Visual inspection of QQ-plots and histograms suggests that all constructs are approximately normally distributed except attitude, which suffers from ceiling effects (with many respondents answering maximum). The results of tests with ANOVA (which is robust to deviations from the normality assumption (Schmider et al., 2010)) show that no mean differences of statistical significance (at the 5%-level) could be found between respondents returning the survey in different months for the four constructs. Nor was any statistical difference in mean values found between those who provided all the information that was required for the analysis and those that did not. Thus, the survey does not appear to suffer from problems due to non-response bias. Furthermore, the number of respondents from different departments, sites and roles match the overall distribution in the organization reasonably well, suggesting that the respondents are representative of the organization as a whole.

Instrument validity

Only five respondents used the feedback section to report difficulties in answering the questions in the questionnaire. Three of these reports concerned difficulties in answering because of the abstraction level of overall policy compliance rather than specific behavior (e.g., practices related to passwords or USB sticks). Two complained about the language and understandability of the questions.

The constructs and relationships of the theory of planned behavior are well established and this survey does not posit new constructs and builds on previous work on how questions should be formulated. Therefore the construct validity of the present survey is to some extent already given. The reliability, i.e., accuracy, of psychological measurements can be measured using Cronbach's alpha [START_REF] Cronbach | My Current Thoughts on Coefficient Alpha and Successor Procedures[END_REF]. The reliability of all constructs except perceived behavior control exceeded 0.70, a commonly used threshold [START_REF] Peterson | Meta-analysis of Alpha Cronbach's Coefficient[END_REF]. The reliability values for perceived behavior control (α=0.69) is on the border of acceptable, meaning that the answers to the three items used to measure these constructs are somewhat inconsistent. This might be because they are operationalized in two dimensions: perceived behavior control is supposed to capture both autonomy and capacity.

Results

The hypotheses stated in section 2.3 are evaluated by assessing if variance in peoples' views about information security policies is lower within groups than within the organization as a whole. In other words, it is expected that a part of the variance in respondents' responses is explained by the group they belong to. Table 1 describes the results of one-way ANOVA tests. The effect size Eta squared reflects the portion of variance explained by the social groups that respondents belong to, i.e., the quotient of sum of squares between groups and the sum of squares of the population as a whole. The p-value reflects the probability that the effect is due to chance. As Table 1 shows, variance in all psychological constructs is lower within departments than within the organization as a whole. The effects are also statistically significant to the 0.05-level on all constructs except perceived behavior control. Thus, H1 and H1.1, and H1.2 are supported in this sample, but not H1.3.

The relationship to knowledge areas is not as straightforward. Considerable statistical significant reductions in variance are found for intention (H2), meaning that H2 is supported. However, a more modest measured and statistically insignificant effect is found for attitude, perceived norm, and perceived behavior control. Thus, H2.1, H2.2, and H2.3 are not supported.

As for knowledge areas, the effect measured by lunch areas is considerable and statistically significant for intentions to comply. However, even though the effect sizes are fairly large for attitude, perceived norm, and perceived behavior control, none of these effects are statistically significant. In other words, H3 can be accepted, but H3.1 H3.2, and H3.3 cannot be accepted.

Overall, the results confirm the hypotheses concerning an influence of social groups on intentions to comply with information security policies. Effects in terms of reduced variance (i.e., Eta-squared) on intentions are between 15 and 18 percent. These results suggest that social processes and structures play a large role in forming the information security obedience intentions. In other words, respondents' intentions to comply with the information security policy is to some extent explained by which department they work at, in which knowledge area they work, as well as who they drink coffee with and have their lunch with.

People within organizational departments are also more homogenous when it comes to attitudes and perceived norms. With a p-value of 0.09 the there is also a tendency that perceived behavior control is influenced by department. However, in contrast to what was predicted, professional knowledge areas and lunch rooms do not appear to explain variance in attitudes, perceived norms, and perceived behavior control. Thus, while people within the same professional knowledge areas and lunch room have homogenous intentions, there is no clear forming effect on attitudes, perceptions of norms and perceptions of how much control they have.

Discussion

The results of this study are far from clear-cut. To assist the reader in the interpretation of the results some of the major issues with the study are discussed below. Issues of dependence between the groups and confound variables are discussed in section 5.1, implications related to the theory of planned behavior in section 5.2, and measurement issues in section 5.3.

Dependence between social groupings and confounding variables

There are apparent relationships between the three types of social groups in the studied organization. First, both knowledge areas and coffee rooms are, to some extent, determined by departments. Knowledge areas are highly concentrated to specific departments because of organizational reasons. In seven of the knowledge areas the respondents comes from only one or two departments; within each of the departments one to seven knowledge areas are represented. Because of a tendency to collocate departments geographically the lunch areas are more likely to be shared by two persons form the department than by two persons from different departments. Overall the respondents use 21 lunch rooms, but within departments between one and nine lunch rooms are used. In addition, 14 of the 21 lunch rooms are used by people from one department only. Second, people within the same knowledge area are often collocated because of the need to interact with each other, and therefore often share the same lunch room. Ten lunch rooms is used by one knowledge area only and most knowledge areas are keep within three lunch rooms.

Unfortunately, the sample size makes it difficult to control for these dependencies by further partitioning of the sample into sub groups (e.g., a particular knowledge area within a specific department). Readers are therefore cautioned to treat the effects as independent. It is likely that parts of the variance that one social grouping explains is also explained by the other social groupings.

Furthermore, the effects on the response variables may be due to confounding variables that have little to do with culture but are related to the social groupings. The explained variance may be due to more direct links to influential variables than the social interaction that follows from these three groupings. It is not necessarily because they share the same culture (e.g., underlying assumptions or values). For example, the effect of knowledge area on compliance intentions might simply be because information security requirements are trickier to live up to for some types employees than others (e.g., because of certain clients), because some researchers are better skilled in tasks required to be compliant (e.g., are schooled in information security) or because information security is a more important issue within some areas.

In addition, variables associated with the Swedish culture and with this particular organization's culture or policies may skew the results obtained. For instance, the managers in this organization may be unusually influential, particularly homogenous knowledge areas may not be present, and discussions during coffee breaks may be unusually relevant or irrelevant to information security.

5.2

Theory of planned behavior as a mediator of cultural phenomena

The theory of planned behavior states that attitudes, perceived norm and perceived behavior control moderate the effect of culture on individuals' intentions. Based on this, one would expect that variables that predict behavioral intentions also predicts attitudes, perceived norm and perceived behavior control. For departments this is the case. Responses to all four variables within groups are more homogenous and the forming effect of these groups may be mediated as the theory of planned behavior claims. However, knowledge areas and lunch areas mean a significant reduction in variance in intentions to comply, but not attitudes, norms or perceived behavior control.

A direct effect on intentions, without mediation by attitude, perceived norm or perceived behavior control, suggests that something is missing in the theory of planned behavior which is common to members in the social groups. As noted above, this missing piece is not necessarily culture alone. It may be an effect of other factors already hypothesized as antecedents to the variables of the theory of planned behavior which are coupled to the social groups, like: knowledge, media exposure, interventions, age, gender, risk perception, moods or personality. Nevertheless, factors captured by knowledge areas and lunch areas seems to influence intentions without being mediated the way the theory of planned behavior say they should be. This warrants further investigations of the sufficiency of this theory with respect to social processes and structures.

Measurement issues

The sample frame used to test the hypotheses addressed in research is well defined: a Swedish defense research organization with highly educated employees, a fairly even age distribution and approximately 1000 employees distributed over four geographical locations. This workplace definitely represents an organization in which information security is of relevance and security policies are important. However, it is only one organization, chosen because it was convenient. Clearly, to generalize from one single organization is risky. Furthermore, the response rate (as low as 18% for some tests) is problematic. Even though no clear signs of response bias can be observed there are problems associated with drawing general conclusions from these results. For example, seven managers in one organization can hardly be said to represent managers/departments in general. And group sizes as small as two or three persons pose another potential source of measurement error if the actual groups (e.g., using a lunch area) are substantially bigger. The small sample also prohibits the use of more sophisticated statistical measures to address the hypotheses. A multilevel analysis was performed using LISREL to identify the effect of a second level on predictions of intention. This analysis suggests that around five percent of the variance in intentions is explained by the groups (department 8%; knowledge area 7%; lunch area 3%) when they are added to a model that already includes the other antecedents (attitude, perceived norm and perceived behavior control). However, with the sample size of this study the effects are insignif-icant and associated with considerable confidence intervals. With a larger sample, multi-level analysis could be used to better test if these types of social groups play a significant role in forming intentions without being mediated by attitude, perceived norms, and perceived behavior control. This would enable assessments of how much variance the social groupings add on top of the variables in the TPB.

Conclusion

In the studied organization, 15-18 percent of the variance in intentions to comply with information security policies can be explained by the department they belong to, knowledge area they work within and lunch room they use. The results are in line with the idea that group phenomena influence security behavior and those social processes and structures play a role for the information security obedience culture of organizations. In addition, the explanatory power of these social groupings based on professional knowledge areas and lunch rooms does not appear to be mediated by the constructs of the theory of planned behavior. This suggests that this theory misses important variables for explaining information security policy compliance.

Appendix: Questionnaire itemsAttitude

  Adhering to the information security policy at [the organization] is: Most people who are important to me think I should adhere to the information security policy that exists at [the organization]. (false<->true) Most people whose opinion I respect would tolerate that I adhere to the information security policy that exist at [the organization]. (improbable<->probable) Most people I respect would adhere to the information security policy at [the organization] if they were in my situation. (unlikely<->likely) Most people at [the organization] who are like me follow our information security policy. (false<->true) Perceived behavior control I am certain that I can adhere to the information security policy that exists at [the organization]. (false<->true) If I really want to, I can adhere to the information security policy that exists at [the organization]. (disagree<->agree) Whether I adhere to the information security policy that exists at [the organization] is entirely within my control. (false<->true) Intention My intention is to henceforth adhere to the information security policy that exists at [the organization]. (false<->true) In the future, I will adhere to all of the information security policies that exist at [the organization]. (unlikely<->likely) Regardless of what happens and which situations arise, I will adhere to the information security policy that exists at [the organization]. (unlikely<->likely) I cannot imagine violating the information security policy that exists at [the organization] even once in the future. (false<->true)

Table 1 .

 1 Variance explained by social groupings.

			Attitude	Perceived	Perceived	Intention
				Norm	behavior
					control
	Departments	Eta-squared	0.06	0.06	0.03	0.15
	(K=5, N=177)	P-value	0.01	0.00	0.09	0.00
	Knowledge areas	Eta-squared	0.05	0.05	0.05	0.17
	(K=11, 178)	P-value	0.17	0.16	0.20	0.00
	Lunch areas	Eta-squared	0.10	0.13	0.11	0.18
	(K=21, N=176)	P-value	0.69	0.36	0.57	0.04

K: The number of groups N: The number of respondents