Information Security and Human Behaviours in Arab Region

This research focuses on the factors that influence human behaviours towards information security in the Arab region, including the nature of Arab culture, trust, and the mismatch with western IT technology. It explores the importance of information security, the role of human behaviours, and the impact of Arab culture on information security practices. The research also examines the relationship between trust and information security, as well as the challenges posed by the mismatch between western and Arab IT systems. The study aims to provide insights into improving information security awareness and compliance in the Arab region.

Contents
1 Introduction...................................................................................................................................4
1.1Overview.................................................................................................................................4
1.1.1Overview of Arab Region................................................................................................4
2 Information security and human behaviours................................................................................6
3 Non-academic contribution......................................................................................................7
Overview of Wasta and Islam..........................................................................................................7
3.1Trust......................................................................................................................................10
3.2 The importance of family.....................................................................................................11
4 Literature review.........................................................................................................................13
Overview and structure..............................................................................................................13
4.1 Objectivise and orientation..................................................................................................13
4.1.1Culture............................................................................................................................14
4.1.2 Trust dynamics..............................................................................................................15
4.1.4 Mismatch with western IT Technology.........................................................................15
4.1.5 Personality types............................................................................................................16
5 Introduction.................................................................................................................................16
Overview........................................................................................................................................16
5.1 Overview of Personality, Trust and Culture within Arab Region........................................17
5.2 Cultural similarity................................................................................................................19
5.3 Research in Culture by Hofstede.........................................................................................22
5.4 Trust.....................................................................................................................................24

5.4.1 Trust and Relationships.................................................................................................24
5.4.2 Arab cultural antecedents of trust..................................................................................26
5.4.3 The Universal Approach towards Trust........................................................................28
5.4.4 Openness to Communication.........................................................................................29
5.4.5 Relationship on Sharing Information............................................................................29
5.4.6 Variables of Shared Culture, Environment and Values in Communication..................30
5.4.7 Style of Management in the Arab world.......................................................................32
5.4.8 Trust in Diversity...........................................................................................................32
5 .5 Western Information Technology.......................................................................................34
5.6 Attitudes affecting the information security behaviours......................................................36
5.7 Personality Factors effects on attitude towards information security..................................46
5.7.1 Neuroticism...................................................................................................................48
5.7.2 Extraversion –Introversion............................................................................................49
5.7.3 Openness.......................................................................................................................49
5.7.4 Agreeableness................................................................................................................50
5.7.5 Conscientiousness.........................................................................................................50
5.8 Personality traits, Information sharing, and Trust................................................................50
3 Methodology chapter..................................................................................................................53
3.1 Research Questions..............................................................................................................53
3.2 Methods and Approaches.....................................................................................................56
3.3 Proposed methods................................................................................................................57
3.3 Rational selection for methodology.....................................................................................75
3.4 Research Paradigm...............................................................................................................77
3.5 Rationale for the Selection of Interpretivism Research Paradigm.......................................79
3.6 Research Design...................................................................................................................80

3.7 Rationale for the Selection of Exploratory Research Design..............................................80
3.8 Use of Mixed Methods- Qualitative and Quantitative.........................................................81
3.9 Research Approach..................................................................................................................81
3.10 Rationale for the Selection of Inductive Research Approach............................................82
3.11 Data Collection Methods.......................................................................................................82
3.11.1 Primary Data Collection Method................................................................................83
3.11.2 Rationale for Choosing the Primary Data Collection Methods...................................83
3.11.3 Primary Data: Questionnaire Survey Method.............................................................84
3.11.5 Limitations of Survey Method as Primary Data Collection Method...........................85
3.12 Secondary Data Collection Methods..................................................................................85
3.12.1 Rationale for Selecting the Secondary Data Collection Methods...............................86
3.12.2 Secondary Data: Library Research Method................................................................86
3.12.4 Limitation of Literature Review as Secondary Data Collection Method....................87
3.13 Phases of Research under Data Collection of this Research Study...................................87
3.13.1 Description of Phase 1.................................................................................................87
3.13.2 Data Collection in Phase 1: Library Research Method...............................................88
3.13.3 Limitation of Phase 1..................................................................................................89
3.13.4 Description of Phase 2.................................................................................................90
3.13.5 Data Collection in Phase 2: Questionnaire Survey Method........................................90
3.14 Sample Size and Sample Technique..................................................................................92
3.14.1 Rationale for Using Random Sampling Method.........................................................92
3.15 Pilot Study..........................................................................................................................93
3.16 Data Analysis Approach........................................................................................................95
3.17 Rationale for Using Graphical Presentation Method.........................................................96
3.18 Authenticity, Bias, Validity and Reliability of the Research Study...................................99

3.19 Research Limitations........................................................................................................101
3.20 Summary..........................................................................................................................104
5 References.................................................................................................................................111
BACKGROUND INFORMATION

1 Introduction
Overview and structure
Introducing the thesis, this chapter will follow multiple phases. It starts by introducing an
overview of Arab region and information security importance, the nature of Arab trust and
culture, and the mismatch between western IT and local Arab IT which covers the whole
dissertation problem, and research objectives. Moreover, a short section that reflects on research
paradigms clarifying that this is an information system research paper. In addition, a personal,
non-academic section to explain the researcher’s background, motivation, and personal
determination. Finally, a short summary of what has been presented before proceeding to the
literature review chapter.
1.1Overview
1.1.1Overview of Arab Region
Arab is considered as a cultural term, and the term is used for the people who speak
Arabic and is their first language. It is found that Arab people can be united on the basis of their
cultural aspects and their history. Within the Arab culture Muslims, Jewish and Christians can be
found. Therefore, it can be said that the people living in the Arab region are not Muslims but also
Jewish and Christians (ADC, 2009). The Arab region is also considered as the Arab world,
which consists of total 22 countries in the Middle East region and North Africa. Some of the
countries, which are included in the Arab region, are Egypt, Iraq, Kuwait, Morocco, Qatar, Saudi
Arabia and the United Arab Emirates (ADC, 2009). It is found that Arab countries have rich
diversity in regard to the ethnic believes, linguistic choices and also religious beliefs. Further, it
has been observed that in the Arab region, the link between Islam and Arab can be seen as the
deep roots of the history. The people living in the Arab region are found to speak Arabic, and it

is considered as the predominant religious language in the region. In terms of life in the Arab
region, it is found that in urban areas of Arab region people have choices in occupations and
freedom for women. Therefore, it can be said that in the urban areas of an Arab region traditional
pattern of the people are changing. As compared to the urban life in the Arab region, it is found
that in rural areas, the cultural roots are found deep in the history (ADC, 2009).
It is increasingly important to ensure high level of information security for both individuals and
organisations (Parson et al., 2014). IT security guidelines are becoming highly advanced and user
friendly. However, employees are less likely to adhere to these guidelines which poses a serious
security risk and that make us wondering: are these guidelines adequate enough for effective
awareness? So a need for better understanding of what could influence employees to comply
and pay more attention to these security guidelines. It is the main purpose of this research to
identify the factors that influence human behaviours in particularly the Arab region towards
information security such as the nature of Arab culture, trust, and the mismatch with western IT
Technology.
However, to extend more depth on this research, this thesis will cover the nature of Arab trust
and culture, and will conduct a statistical analysis after collecting completed questionnaires from
participants, to determine the mismatch between western culture and Arab local culture and
partially personality factors and their impact on IS awareness training.
Despite the understanding of information security issues found in organisations, researchers have
explored the understanding of human attitude and behaviour towards information security but
there seems a lack of research on how the understanding of the local culture may help us to
differentiate or isolate the issue that has been found within Arab culture such as trust,
information sharing culture, and resistance to western IT Technology.
However, the focus of this research is narrow; it is only interested in the nature of Arab trust
towards information security, the local culture, the mismatch between Arab local system and
western based system, the transfer of western technology to the Arab region challenges.

2 Information security and human behaviours
According to Siponen, Seppo, and Adam (Siponen, 2007), in the last few years, the importance
of information systems security has increased as witnessed by the number of incidents that
organisations have encountered. Employees rarely comply with the security policies, procedures,
and techniques which places the organisation assets in danger.
According to Inaugural International Conference on Human Aspects of Information Security and
Assurance, It is been acknowledged that the requirements of security can’t be addressed by
technical means only, and the important aspects of protection comes down to four dimensions,
attitude, awareness, behaviour, and capabilities of people involved, therefore employees or users
should be seen as a vital elements to build a successful security strategy (HAISA, 2007). Authors
such as Schneier, Pincus, and Heiser, stated that, in order to achieve an acceptable level of
information security within an organisation, human factor aspects should be considered as a
critical element rather than just focusing on software and hardware vulnerabilities (Schneier et
al., 2004).
Stanton, Stam, and Mastrangelo (Stanton et al., 2004) stated that information security research
focuses on algorithms, methods, and standards that support the three basic functions of
information security such as confidentiality, integrity, and availability (CIA). Concepts, theories,
and research that are relevant to human behaviour have been receiving increasing attention by
researchers on how human behaviour affects information security.
Binden, Jormae, Zain, and Ibrahim ( Binden et.al., 2014) suggest that protection of data and
critical information such as trade secrets and proprietary information is among the aspects that
have gained much emphasis recently due to the rising cases of infringement and theft of
confidential information from individuals and enterprises. Many of these infringements can be
attributed to human error.
According to NIST and Computer Security Act of 1987, the information integrity,
confidentiality, and availability of Federal agencies and organisations cannot be protected in
today’s highly networked systems environment without effective training and having users

involved understands the roles and responsibilities of their works and adequately train them to
perform them in more secure way (NIST, 1998).
In November 1989, the National Institute of Standards and Technology (NIST) working with
U.S. Office of Personnel Management (OPM) have developed and issued guidelines for Federal
computer security training. However, in January 1992, the Office of Personnel Management
(OPM) has issued a revision of federal personnel regulations related to the guidelines which were
voluntary and made them mandatory. As indicated by NIST, OPM regulations required training
for current employees, new hires within 60 days, a significant change in the IT security
environment or procedures of the agency, change positions of employees which deal with
sensitive information, and periodically as a refresher training for employees who handle sensitive
information.
3 Non-academic contribution
Overview of Wasta and Islam
This is a separate section I thought to include as I believe it is related to Arab culture in the real
life nowadays. As an observation, I have found that the Wasta is exists within Arab countries for
many years and as a results of that, the Wasta within Arabs becomes a key to build a
relationship at different level within their culture therefore the trust that this research is
addressing becomes vital to maintain their relationships. Much like China, the basic rule of
business in the Arab World is to establish a relationship first, build connections, and only
actually come to the heart of the intended business at a later meeting. There is a master
assumption that a network or web of connections already exists and the issues concern if, and
how, it may be accessed. In traditional Western models the emphasis is on the immediate
transaction itself. Thus in the Arab milieu much that subsequently transpires appears to be in
direct contrast to Western practice in which focus is placed on ‘getting the deal done’ and a
friendship- may only develop later as a separate function to the business transaction. Just as in

China, the Arab process of building relationships prior to transacting business is very time
consuming.
However, once a relationship has been established verbal contracts are absolute and an
individual’s word is his/her bond and failure to meet verbally agreed obligations will certainly
lead to a termination of a business relationship. Three factors are core to business and society in
the Arab World. Firstly, the global philosophy of Islam is based on practice rather than dogma.
Secondly, there is an expectation that good practice of Islam is what all Muslims do, Thirdly,
Muslim societies are wholly networked and all business activities revolve around these networks.
Like its Chinese counterpart guanxi, Wasta thus also involves a social network of interpersonal
connections rooted in family and kinship ties. Involving the exercise of power, influence and
information-sharing through social and politico-business networks, Wasta is intrinsic to the
operation of many valuable social processes, central to the transmission of knowledge, and the
creation of opportunity. Just as guanxi has a positive connotation of networking and negative
connotation of corruption, so too does Wasta and it is possible to refer to good Wasta and
negative Wasta. Though Sawalha (2002) suggests that Wasta, as the use of connections for
personal gains, commonly stands for nepotism, cronyism, and corruption in general, and, is a
deeply rooted practice among all segments of society and in all sectors, this was not the original
meaning of Wasta. Wasta is literally defined as Arabic for connections or pull and may be
utilised as a form of intercession or mediation. Traditionally, the head of the family in Arab
nations performed Wasta services by obtaining for the supplicant what is assumed to be
otherwise unattainable. In recent years, Wasta has come to mean the seeking of benefits from
government. Though Wasta pervades the culture of all Arab countries and is a force in all
significant decision making, it is not usually mentioned by most writers nor is it openly discussed
by Arabs themselves (Sawalha, 2002). By illustration one could point to a typical response to the
question of Wasta continued influence. A Western business person may ask an Arab colleague
whether Wasta is still influential in business transactions s/he will very probably at first say no
but then if the Westerner asks if Wasta will become irrelevant in Arab business and society, the
response will be an emphatic reply that Wasta is central to all Arab life. If the questioner
proceeds to express condemnation or dismay at the existence of Wasta in a specific business
situation they may be listened to courteously but discreetly humoured as possibly naïve or
inexperienced. But too much acceptance and understanding may also be taken as an adverse sign.

In principle Arabs are permitted to criticise Wasta in ways that from a Westerner would be
considered unacceptable. Thus HRD managers are advised to train their international managers
from a non-Arab background in the need to learning how to manage what may not be directly
acknowledged or discussed.
Cunningham and Sarayrah (1993) argue that Wasta has changed over time and its main goal has
shifted from conflict resolution as a means of survival to intercession, and the term denotes the
person who mediates/intercedes as well as the act of mediation/intercession (Cunningham &
Sarayrah, 1994). Intermediary Wasta endeavours to resolve inter-personal or inter-group conflict
and a jaha (wajaha', mediation group of notable emissaries sent by the perpetrator's family to the
victim's family) acts to inhibit revenge being taken following an incident involving personal
injury (Cunningham & Sarayrah, 1994). Wasta as mediation binds families and communities for
peace and well-being in a hostile environment and this form of Wasta benefits society as a
whole, as well as the parties involved (Cunningham & Sarayrah,1994). Intercessory Wasta
involves a protagonist intervening on behalf of a client to obtain an advantage for the client, such
as a job, a government document, a tax reduction, or admission to a prestigious university. In
instances where there are many seekers of the same benefit, only aspirants with the strongest
Wasta are successful (Cunningham & Sarayrah, 1994). In Western business it is common to
negotiate with only one organisation at a time after initial quotes have been received. In the Arab
World negotiations will be conducted with several businesses simultaneously and the
organisation to win the deal will usually be the one with the strongest Wasta connections. The
lesson for international managers is to avoid placing all their efforts on the product/service
delivery but rather to invest their time and resources in the requisite business acumen of
cultivating strong connections. In this context there is no substitute for achieving a good
reputation for honest dealing. Western managers may come unstuck if they presume to act as
they believe local managers from an Arab background might behave. Indeed, any inference
relating to such topics as “corruption” may be very bitterly resented.
3.1Trust

It has been argued that attempts to regulate traditional forms of networking, particularly the Arab
Wasta, by legal or juridical constraint usually fail because they are intrinsically tied to trust and
social structures and family connections (Weir, 2003a). For the Chinese, emotional trust is more
important than cognitive trust, and is based on sentiment-based ties between individuals which
may also be extended to others through the relationship network, guanxiwang (Gao & Ting-
Toomey, 1998). Xinyong (trust) literally means the use or usefulness of trust but also refers to
the integrity, credibility, trustworthiness, or the reputation and character of a person (Kiong &
Kee,1998). Moreover, when an individual helps one’s guanxi, that individual’s reputation is
raised and trust and mianzi (face) won from others. Trust is also associated with the importance
of one’s word over legal documents. When trust has been established, one’s word can be taken in
business transactions – to go against one’s given word is to lose face and trust and ultimately
one’s good guanxi. Reciprocity is also linked to guanxi and trust with an unwritten rule that one
must Payback + 1 when a favour has been provided. Relations of trust between business partners
are integral to successful business transactions in the Arab World also. While the Western world
relies on formal agreements and legally-prepared and signed contracts, once a trustful
relationship has been established in the Arab World business partners need only give their word
of honour in business dealings (Demirbag, Mirza & Weir, 2003). Consultation or Shura is
central to business relationship in the Arab World (Siddiqui, 1997) and decisions carry great
importance as they are deemed to have been made on behalf of Allah. Though trust is endemic to
business and social relationships, participation is a key and consultation means the right to
appeal decisions (Espisito, 1988). While trust in China hails from Confucian philosophy, trust in
the Arab World is rooted in Islam and faith in God. It should be noted, though, that while the
word of an Arab is his/her bond, the phrase ‘Insha’Allah’, literally “if God wills it” can be a
simple statement or a form of words covering the strong possibility of inaction or even a negative
outcome to apparently agreed courses of action. Weir (2003a) argues that, by its very nature, this
is an indefeasible expression, for all outcomes represent the will of God and what eventually
happens, or does not happen, is equally an expression of Divine will. The successful
international manager is one who recognises this pre-existing state and who works slowly but
surely towards gaining the trust of his/her Chinese and Arab counterparts.

3.2 The importance of family
Family is of central importance in both China and the Arab World. In China, the notion of family
encompasses the extended family and the wider community. Not only do people feel a sense of
obligation to their family, but also an obligation to save and maintain face for their family and
extended networks. Reciprocal obligations are not limited to family and kinship only but also to
non-kin ties in which people are expected to help each other as if they are fulfilling obligations to
their family members (Bian & Ang, 1997). This reciprocity is integrally tied to guanxi and
further extended to the repayment of business and social deeds, and those that fail to deliver, may
be “labelled as bugou pengyou, or ‘not enough of a friend’” (Seligman, 1999, p. 36). Family
forms the basis of business organisation even more so in the Arab World than China. Moreover,
the family in the Arab World is the primary Wasta channel (Muna, 1980). The formalities of
social, family and political life are strictly preserved, even in managerial settings. Just as Chinese
business culture revolves around banqueting, it is impossible to undertake any kind of meeting in
an Arab organisation without the ubiquitous coffee or tea rituals associated with the ‘diwan’. The
traditional tribal Wasta, the shaykh, was a man of honour, whose word was his bond and whom
would assume responsibility for his acts (Cunningham & Sarayrah, 1994).
Although originally based upon family loyalty, Wasta relationships have expanded to
encompass the broader community of friends and acquaintances as does guanxi in China. It is
further argued that Wasta -based recruitment and allocation of benefits reinforce family ties,
thereby connecting the individual to the economy and polity. Indeed, Cunningham & Sarayrah
(1994) and Weir (2003a) proffer that the importance of family connections is so great that how
people are admitted to university or hired for a job is less important than their performance in
class or on the job. Moreover, where a close family member appears at the office of even quite a
senior manager, it is regarded as improper for the demands of organisational hierarchy to take
precedence over the obligations due to family (Sulieman 1984). International managers can
never assume the position of a close family member but they are advised to work with Chinese
and Arab middle managers and business partners as intermediaries to form a more trustful bond
with their employees and business associates. In so doing they can work towards a situation of
insider status and knowledge sharing which will be of long-term profit to their organisation
Favours. In both China and the Arab World the notion of favours is tied to guanxi and Wasta
respectively. Yet, while the Chinese differentiate between favours that support guanxi

relationships and bribery and corruption, in the Arab World the idea of favours is generally
regarded as having negative connotations, despite being widely practiced. In China, the value of
guanxi depends upon the element of ganqing or affection that is tied to renqing (favours) (Kiong
& Kee, 1998). The word renqing indicates individual emotional responses of daily life and
translates into a resource allocated to another person as a gift and connoting a set of social norms
to guide an individual to get along well with other people (Wong & Tam, 2000). It has also been
used to refer to bribes. However, as the use of bribery is universally condemned in China,
particularly now that there has been the introduction of laws specifically dealing with corruption,
the Chinese themselves make a sharp distinction between bribes and favours. While giving cash
is usually viewed as buying someone’s services and hence is condemned, gift giving may
constitute bribery or can be simply guanxi cultivation, depending on the intention and who is
giving. Yet, Guthrie (1998) maintains that corrupt practices are increasingly considered backdoor
as actors play more and more attention to the laws, rules and regulations that are part of the
emerging rationale-legal system. Managers of large private organisations, he argues, increasingly
view guanxi practice as unnecessary and dangerous in light of new controls and official
procedures (Guthrie, 1998). Therefore the extent to which international managers may be
required to exercise favours is declining and may only necessitate the type of business
entertaining that occurs in Western business. Arabs are increasingly concerned that favours are
being interpreted as an attempt to change the behaviour of the recipient. In a pioneering opinion
poll carried out by the Arab Archives Institute in 2001, 87 per cent of respondents stressed the
need to eradicate Wasta, viewing it as divisive and symptomatic of corruption, even though
more than 90 per cent also responded that they believed they would be using it at some point in
their lives (Sawalha, 2002). Weir (2003a) notes, however, that the exchange of gifts in the Arab
World, which often puzzles or offends Western managers, should not necessarily be construed as
an attempt to influence the judgement of a recipient but may be interpreted merely as a mark of
respect. Moreover, it is to signify reciprocal acceptance of status and marking the initiation or
honouring of an agreed bond - and to this end Wasta shares similarities with Western business
custom.

4 Literature review
Overview and structure
This critical review is in different distinct parts. The first asks the fundamental question, how
local culture influence attitude towards information security and the transfer of western IT
Technology. Following this, we identify how trust factor as found within Arab region influence
information sharing at different level of trust and causing employees to share confidential
information in the workplace and why do people share confidential information in Arab culture
when it comes to information security? Is trust influenced by culture in this region? The final
section will be covering the mismatch between western system and Arab region culture, a non-
focused area on personality factors, and the summary of the literature.
4.1 Objectivise and orientation
Overall the research aims to present literature relevant to IS security in the Arab region.
The western Information system at some point failed to be accepted by Arab culture
due to some barriers which will be presented in this research. However, it did work for
westernized people who have been educated in these developed countries but the
majority of those who are living in the Arab culture didn’t specially aged people and
some young people who live in villages which lead to this investigation. The objectives
of this research are to identify the factors that impact the accepting of western IT
Technology, attempt to isolate or propose a solution, and to reduce the mismatch
through possibly customised training. The research will look at these factors as
following:

4.1.1Culture
This section contrasts the cultures that predominate in the Arabian Gulf with those that
predominate in the west. As the research focus in the adoption of IS security in the Arab
region this is also the main focus of the review. Accordingly, this section attempt to
review all scholarly literature on the subject of Arabian culture as it is manifest in the
gulf. For contextualisation purposes, this section also review some literature on
Western cultures is so far as they contrast with those in the Arab region; however this is
not the primary focus of the review.
This comparison purposes in this section also takes a cursory look at western cultures
and provides an overview of western culture in so far as it related. For contrasting
purposes literature related to western culture, in so much as it aligns with Arab cultures
is also reviewed. This section covers the nature of Arab culture in general and will
focuses on the nature of Arab culture specifically as a main focused area which will
then present the first research question and attempt to answer it.
According to Abah (2011), cultural pasts and modernization in the Arab region such as
United Arab Emirates and Saudi Arabia contribute to the vivid tensions of cultural
present of the Arabs. The Arabs emphasize on their Arabic style of traditional culture
despite the engagement of the nationals with modernized communities. This interesting
significance of tribal agreements remains as valuable features of in the emirate rule
among the locals. The tribe of the Bedouins traditionally lived nomadic lives in the
desert. They traded with livestock as they shifted from one oasis to another for their
livestock. Interestingly, this cultural past can be observed in the present culture among
the Arabs. Though the Bedouin now live in houses, they insist on dwelling in tents in
their gardens. Also, those in Dubai with white collar jobs live in the city. However, they
prefer taking holidays in the deserts while living in tents. The Arabic culture tends to be
pervasive and deeply rooted.

4.1.2 Trust dynamics
To introduce the subject, this section provides an overview of trust as defined within
sociology and psychology. More specifically, papers are then reviewed relevant to trust
as a component of Arab cultures along three themes, namely:
 Trust scale in General
 Trust in close relationship
 Trust in families members
 Trust in leaders
 Trust in people
The intention was to gather all scholarly articles related to these latter areas. The themes
mentioned were not set out beforehand but are those that emerged as major literature
conversation during the review. This section begins with reviewing key documents that
provide a salient over view of trust.
This section covers the trust factor at different level such as trust in relationships, leaders, close
friends, tribe or family members, and general trust. One of the vital cultural factors is trust.
Existing research in this area seems to indicate that members of Arab communities tend to have a
high level of trust based on shared values, so further research is needed to identify the different
trust dynamics levels.
4.1.4 Mismatch with western IT Technology
This section will cover the issues found within the Arab region based on the findings on
culture and trust and will attempt to isolate it or if possible present a logical solutions to
it. Transferring Information Technology (IT) to bring it into practice is difficult for
many countries, and they even fail to transfer it. The major obstacles that are faced
while transferring IT into practices are cultural and social norms of a developing

country. It has been identified that in Arab society the cultural beliefs of the people of
various occupational groups differs on the basis of the construct of the technology in
their daily lives (Hill et al., 1998).
4.1.5 Personality types
This section will cover a contribution to a better understanding of how the Information
security Training can be better customized based on personality factors. However, this
section will not be the focused area of this research but will present hypothesise that
will help to improve the Information security Training Awareness.
5 Introduction
Overview
The proposed plan of this research is to attempt to answer research questions by examining or
identifying the nature of Arab trust comparing to others. Moving further, this research will
extend more on investigating the role of trust on sharing information as found or observed in
Arab culture and whether this has something to do with certain aspects of the culture and if so, to
what extent does culture affect attitude towards IS. Finally, the research will seek to identify
ways to reduce the gaps between western based security awareness training and Arab culture.
We must consider the influence of the local culture and how this may impact the findings of this
research. A person having certain attitude who is expected to behave in a certain way when
subjected to a situation may not exhibit the expected behaviour due to cultural restrictions. For
example Arab people tend to be trusting towards other members of their community which is in
contradiction with IS principles.
One of the vital cultural factors is trust. Existing research in this area seems to indicate that
members of Arab communities tend to have a high level of trust based on shared values (Putnam

&Nicotera (2009), so further research is needed to investigate possible ways to make adjustments
to the level of trust and therefore reduce the mismatch between western ISAT and the local
culture. ISAT should be also customised based on additional aspects of Arab culture.
According to Lewicki and Bunker, (1996), Rempel, Holmes, and Zanna, (1985) and Lewis and
Weigert, (1985), trust in relationships is developed in different foundations. They range from
empathy in collective calculations, affective bonds, confidence in one’s counterparts and concern
for welfare. On the other hand, many researchers such as Bulter (1991), Zucker (1986) andCook
& Wall, (1980) attribute the growth of trust to the sharing of information with confidence of the
reliability and competence of the counterparts.
As per the report presented by UNESCO Science Report, Towards 2030, from the period 2004 to
2014, the Arab region has faced political instability, but at the same time, it has been observed
that the Arab region has made progress by putting its efforts in many fields, such as R&D. The
expenditure made by the Arab countries has also helped them in generating revenue (UNESCO,
2016). It is also observed that the participation of women in the Arab region is found less as
compared to men, but at the same time, it is observed that the participation of women in science
and research sector is measurable as compared to men. It is found that the countries in the Arab
region are taking steps in order to have more women participation in all fields existing in the
region (UNESCO, 2016). In regard to the science and research sector in Arab region, it is found
that the countries are rich in this sector and also in the oil and gas industry. Therefore, the
countries in the Arab region are taking steps so that they can use their technology and its
advancements to develop improve the oil and as a sector. The countries in the Arab region have
initiated with the help of Renewable Energy and Energy Efficiency Programme (UNESCO,
2016).
5.1 Overview of Personality, Trust and Culture within Arab Region
It can be said that trust is made in the form of relationship between various individuals
which helps in building confidence regarding one’s counterparts and also their welfare (Abah,
2011). If there are many uncertainties and instability between the relationships, then it can be
said that trust cannot be developed. It can also be said that it is the need of the business

environments that there are trust and relationship among the employees working in the
organisation and also between the employers and employees (Abah, 2011). Therefore, it can be
said that the environmental factors are also responsible for building trust and relationship among
the individuals of an organisation or a country. Further, it can be said that culture of a place is
based on the communication level or culture is viewed as a form of communication. Thus, it is
essential that the communication level of a place is understood by every individual living at that
place (Abah, 2011). While communicating with other individuals at a place, it is necessary that
the message is decoded by the individuals properly and the individuals should also understand
the culture and value used while communicating. It can be said that with the values of a place its
cultural values also improves (HöHmann and Welter, 2005).
In Arab region, it is observed that the cultural presence of the countries can be seen
through modernisation and culture followed by the people. It is found that the Arab countries
have their main focus on the traditions that are followed in Arabic style by the people over the
years even though the people living in the Arab region are found to be modernised. The Arabic
culture can be seen through the lifestyles of people living in the Arab region (Abah, 2011).
Therefore, it can be said that in the Arab region, the cultural aspects are deep rooted. Further, it
can be said that inequalities exist between the Arab nations regarding their cultural aspects. It is
also seen that in workplaces, authoritative policies are followed where it can be said that unequal
distribution of power exists between the higher and lower end of people working in the
organisation (Abah, 2011). At the same time, it is also found that the nations in the Arab region
has a high level of trust among them and they are also willing to share information with each
other; therefore, it can be said that possibility of misunderstandings is less and people have a
positive attitude (Abah, 2011).
In the perspective of Lunt, Horsfall and Hanefeld (2015), it is found that trust is the most
important factor that is required while doing business. On the basis of trust factor of a company,
it has a reputation in the market, brand recognition and also offline presence. In the Arab
countries, trust is dependent on the relationships between the people or the company. On the
other hand, in the western countries trust can be found on the basis of the contracts and
agreement made between people or the companies (Lunt, Horsfall and Hanefeld, 2015).
In the views of Chrysostome (2014), trust is considered as one of the important aspects in
the Arab region as it helps in developing relationship marketing among the Arab countries. Trust

and commitment show the shared value between the organisations in the Arab region. Further, it
is found that trust is deep rooted in the Arab region and is reflected through the businesses
running across the countries (Chrysostome, 2014). It is observed that most of the businesses
running in the Arab world are run by the family members. Trust is the foundation of the Arab
families, and it is found that the families consider that businesses should run on the basis of trust,
which should not be broken. Therefore, it can be said that for running an effective business in the
Arab region, the organisation must have trust attribute in the market, which also defines their
reputation (Chrysostome, 2014).
According to Hessle (2016), the main reason behind the trust in the organisations in the
Arab region is that they want to build a society based on trust and also want to build a hard
working society. It is found that the organisations which are based on trust and the employees are
hardworking, then the organisation results in improved productivity and increased profitability
(Hessle, 2016).
As per El-Shibiny (2005), it is found that the Arab countries find trust as an important
aspect to develop relationships between two people or companies. In the Arab region, people
have shared values and also find to have linguistic similarities; therefore, it can be said that
shared value and similarities in the Arab region leads towards trust (El-Shibiny, 2005). Deep
roots of trust and shared value among the people shows that people have loyalty to them and also
the work is done fairly. Shared value culture and trust among the people have led towards
removing any kind of barriers among the people (El-Shibiny, 2005).
5.2 Cultural similarity
Trust is based in similarity of language, traditions and religious backgrounds. In every
form of interpersonal relationship, similarity in these backgrounds can be associated with
particular attributes for a given outcome. Mainly, trust facilitates communication and increased
confidence in security of confidential information. As cited in Putnam&Nicotera (2009), Hall
(1959) noted that “Culture is communication and communication is culture” (p. 167). In this
respect, communication can be considered as an additional antecedent of trust. Through trust in
communication, individuals can engage in communication to resolve disputes, align expectations
and perceptions. Hall (1959) stressed on the value of communication in culture. He further noted
that communication creates a mechanism for conveying and decoding information that pertain to

the lives of counterparts. Through similarity in language, individuals can create an organized
schema for observing and comprehending the events of the world. For communication to occur
effectively, interaction between partners is necessary. Interaction in communication can be based
on similarity of culture or other aspects that affirm understanding. Also, repeated communication
builds competence in establishing trust. The quality of interaction significantly determines the
level of trust between counterparts. In this respect, face to face interactions may be valued higher
than other forms of interactions. Face to face interactions make memorable and significant
development of environments for sharing confidential information. Face-to-face conversations
between individuals of diverse national cultures contribute to the rise of frequent matters. In
some instances, such matters may be hinders by differences in language. People from different
cultural backgrounds, self-identities, morals and values could significantly hinder
communication. Different cultures allow for different approaches in expression of perceptions,
emotions and other phenomena. These differences significantly contribute to possible problems
and miscommunication. In this respect, individuals that interact without similarity in values may
encounter major difficulties in communication.
In both the European and Arabic nations, shared values and culture play a significant role
in business and social relations. Many aspects of effective relationships involve engaging with
people in the capacity of stakeholders, employees, customers or suppliers. Research into cross
cultural interactions is widely being applied in global and modern practices and techniques of
management. A study into the impact of culture and shared values in management in Arabic
countries by forms the focus of this section. The theoretical insights drawn from the study
involve the fundamental antecedents of trust in business. Also, the study focused on the residents
of the Emirates and their value of trust and culture in relationships. Reviews that were captured
included:
1) Critical examination of shared values and culture
2) Culture and trust in business
3) Antecedents of trust among the Arabs
4) Management practices in Arabic states
Often, conducting studies in the field of cultures and shared values involves overcoming
challenges of accurately defining the meaning of culture. Culture is widely defined in existing

literatures. Also, diverse dimensions and conceptualizations of culture have been introduced.
According to Corbitt, Peszynski, Inthanond, Hill, &Thanasankit, (2004),the complex nature of
culture makes it difficult to define it. Primarily, culture encompasses both intrinsic and extrinsic
values and elements. Often, the elements of culture are defined by basic assumptions, behavior,
norms and values. Many researchers, Neal, Finlay, Catana, &Catana, (2007), Khan and Khan
(2015) and Lauring&Bjerregaard, (2009) have conducted studies on the shared elements of
culture and values.
According to Mooradian, Renzl&Matzler (2006), one hundred and sixty definitions of
culture were introduced by Kroeber and Kluckhohn in 1952. The researchers further note that
these definitions multiplied to four hundred by the year 1994. Culture occurs as an essential
aspect in social and behavioral sciences. As a result, the definitions and conceptualizations of
culture increase over time. In sociology, the concept of culture is defined as a compound set of
patterns of behavior and characteristics shared by the participant members of the society.In
addition, the definition includes the shared feelings, beliefs and attitudes of members of the
culture. The article review by Kendall, Woodward, &Skrbiš, (2009) based on the studies of
Braithwaite & Thompson (2000), Pool (1973), Putnam &Nicotera (2009), aimed at analyzing the
numerous instruments used in their quantitative research in measuring culture. In conclusion,
culture involved the following primary elements.
1. It is multi-level and complex
2. It is shared by individuals within the same society or group
3. It is stable
4. Is established over a long period of time
A study on the Arabic culture and values indicated that these four elements are included.
However, these elements of culture among the Arab apply differently to men and women.
Further elements concerning the Arabic culture in disclosing confidential information are based
on the Hofstede’s research.

5.3 Research in Culture by Hofstede
In his quantitative research conducted at IBM to measure culture and its consequences, Hofstede
used diverse sources of data to make his findings on culture at within working areas. Hofstede
defines culture as mental software that individuals employ when needed to form a particular
belief. He further noted that culture enforces a defined pattern of thought. This pattern can be
reflected in the manner of interaction or behavior of a particular people. In his original study,
Hofstede conducted his research among employee of IBM across more than fifty countries in the
world. The study led to many findings that required diverse strategies and ways of approach.
These findings include:
1. Inequality in relationship of the society with authority
2. Defined association of a group and an individual
3. Division of social institutions by their level of femininity or masculinity
4. Approaches of managing expression of emotions, uncertainty and control of aggression
5. Short term versus long term positioning of life
Hofstede further grouped the findings by five dimensions with factors that can be associated with
arbitrary culture in the world.
1. Power distance
Hofstede defined powered distance as the degree to which power is accepted among the
members of the society. Also it defines the unequal or equal distribution of power in the
society
2. Collectivism versus individualism
Collective societies include communities that encourage cohesion and strong social links.
On the other hand, individualistic cultures tend to be less cohesive. Here, individuals of
the society do not engage in the lives of other individuals
3. Femininity versus masculinity
Feminine cultures tend to exhibit equal distribution of gender roles among both women
and men. The overlapping of the roles promotes loyalty within the community.
Conversely, masculinity refers to communities that tend to be highly competitive. Also,
gender roles among men and women tend to distinctly elaborated.
4. Uncertainty avoidance

Hofstede associated different cultures with different levels of tendency to embrace
situations of unknown outcomes. High uncertainty avoidance results in rules that enable
members to avoid such situations.
5. Long-term orientation versus short-term orientation
This factor elaborates on dynamism in orientation towards life. Long term orientation
involves sense of shame, high value of relationships and status, thrift, persistence and the
opposite pole. On the other hand, short term orientation involves saving face,
reciprocating gifts and favors, high regard for tradition and customs and personal
steadiness.
These factors and terminologies were derived from social sciences. According to
Hofstede, these factors can be distinctively applied in distinguishing national cultures. Therefore,
this paper draws distinction between the UK and the Arabic nations.
Comparison to the United States ,Great Britain and Arab countries
Power
Distance
Uncertainty
avoidance
Individualism
/collectivism
Masculinity/
Femininity
Long-/
Shortterm
Orientation
Country Index Ran
k
Index Rank Index Rank Index Rank Index Rank
Great
Britain
35 42–
44
35 47–
48
89 3 66 9–10 25 28–
29

United
States
40 38 46 43 91 1 62 15 29 27
Arab
Countries
80 7 68 27 38 26–27 53 23
Table 1 clearly compares the variation in scores of the Great Britain, United States and the Arab
nations.
(SOURCE:Putnam &Nicotera (2009))
The comparison indicates that Arab nations have bigger scores of 80 in power distance as
compared to 40 and 35 for the United States and the Great Britain respectively. Moreover, the
Arabic nations ranked 7 out of the total 50 nations. In discussion, the high scores in power
distance indicate that the Arabic nations tend to have larger sense of inequalities within their
cultures. The desired or expected authoritarian concepts exist in the workplace. Here, an unequal
hierarchy of status among the lower and higher end of the society persist. Also, due to strong
centralization, the subordinates may be required to never work without the instruction of their
superiors. Also, managers practice utmost benevolence and bureaucratic leadership at the
workplaces. In this respect, the people in authority often receive high status privileges and power
is popularly unequally distributed among the nationals.
5.4 Trust
5.4.1 Trust and Relationships

Various studies conducted previously associate the quality of relationships with
environmental factors such as shared values and culture. According to Corbitt, Peszynski,
Inthanond, Hill, &Thanasankit(2004), environmental factors occur as a cultural precursor of
trust. Therefore, uncertainty or instability in the environment generates low levels of trust.
Therefore, environmental benevolence significantly influences quality of relationships through a
complex formula of correlation. The environmental factors referred to in the research encompass
social and economic aspects. Another study by HöHmann& Welter (2005) discusses expertise in
service entrepreneurship. This study relates to that of Corbitt, Peszynski, Inthanond, Hill,
&Thanasankit (2004) although the focus shifts from consumer environments to business
environments. The business environment requires utmost trust and not necessarily a focus on
shared beliefs or culture. The author further argues that the cultural market positioning of a buyer
firm acts indirectly as a precursor of the level of loyalty exhibited to the main supplier. Barry
(2004) conducted a study in 42 states on the antecedents of trust that are driven by culture. The
study included factors such as collectivism and wealth in the nation of the buyer. In conclusion,
the study noted that trust building actively involved social behaviors. Moreover, the conclusion
explained that these dominant social behaviors were significantly influenced by culture.
Another study by Theron et al. (2008 as cited in Agourram, 2009 p. 34 - 48) conducted a study in
the financial services industry in South Africa. It involved relationship managers and clients of
the industry. The study concluded that commitment to a relationship involves four valuable
antecedents. They include:
1. Commitment in relationships is driven by trust
2. Sustenance of commitments in a relationship requires effective communication.
Communication reduces perceived risk and uncertainty in sharing information.
3. Similarity in levels of relationship commitment and shared values play a significant role.
These aspects contribute to the alignment of business values. Furthermore, the author
cited the need to consider cultural differences of clients. Here, the study referred to
uniqueness of financial services that Muslims require.
4. Since clients of financial services value the range and width of services by financial
service providers, comparison and attractiveness of alternatives should be noted.
Theron et al. (2008) associated religion with shared beliefs and culture. The author made
this conclusion upon considering the uniqueness of financial services required by Muslims.

However, (Agourram, 2009) noted that studies on the impact of shared culture and values tend to
incorporate the aspect of religion ultimately. The author notes that further research based on the
same valuable could be conducted in the Arab/Muslim nations. Another study was conducted by
Gefen, Rose, Warkentin, &Pavlou, (2008) on internet communication between exporters from
United States and their distributors. The study concluded that a positive relationship existed in
internet communication and cultural distance. This means that the greater the cultural distance
the higher the frequency of business letters, facsimile, email and telephone communication. In
conclusion, internet communication does not abbreviate the cultural differences. This study
based its variables on those identified by Hall (1983). According to Gefen, Rose, Warkentin,
&Pavlou, (2008), culture can be viewed as a form of communication. In addition,
communication needs to be decoded appropriately so as to derive the intended understanding.
During the process of decoding, individuals from different cultures may derive a different
understanding form the same message in consistence with their cultures and value. In this aspect,
minimized convergence of values indicates increased “cultural distance”. According to Hall, this
instance can be referred to as LC (low context) or HC (high context) dichotomy. In LC (low
context) dichotomy communication, the message conveyed holds adequate details and
information for the sender and receiver to agree. The message is said to be factual and specific.
In HC (high context) dichotomy communication, the message conveyed tends to be less detailed
and less explicit. Gefen, Rose, Warkentin, &Pavlou, (2008), argue that cultural contexts in LC
(low context) or HC (high context) dichotomy bear a significant influence on the types and
amount of messages that would be needed to ensure effectiveness in communication. The study
found increased frequency in communication between LC (low context) or HC (high context)
distributors and exporters. Primarily, limited study on shared beliefs and values and culture as
antecedents of trust have been conducted. Often, studies with similar variables tend to
concentrate on organizational culture and expertise in the service environment. The authors
recommend that other studies should be conducted with an emphasis on interaction of culture,
shared values and communication.

5.4.2 Arab cultural antecedents of trust
According to Abah (2011), cultural pasts and modernization in the United Arab Emirates
contribute to the vivid tensions of cultural present of the Arabs. The Arabs emphasize on their
Arabic style of traditional culture despite the engagement of the nationals with modernized
communities. This interesting significance of tribal agreements remains as valuable features of in
the emirate rule among the locals. The tribe of the Bedouins traditionally lived nomadic lives in
the desert. They traded with livestock as they shifted from one oasis to another for their
livestock. Interestingly, this cultural past can be observed in the present culture among the Arabs.
Though the Bedouin now live in houses, they insist on dwelling in tents in their gardens. Also,
those in Dubai with white collar jobs live in the city. However, they prefer taking holidays in the
deserts while living in tents. The Arabic culture tends to be pervasive and deeply rooted.
A study by Corbitt, Peszynski, Inthanond, Hill, &Thanasankit (2004) aimed at finding
solutions for challenges encountered by young Arabs in their financial workstations. The high
rates of attrition among banking Arabs contributed to the study. The authors argue that other than
current focus on economic values, banks needed to realign their training and education towards
values of Arabic cultures. Mainly, the economic value involved planning, economic mentality,
productivity, profitability and annual income. Contrastingly, students highly valued religion,
intellect, politics, beauty, social value and economic values in that order. The study observed that
the lack of alignment in priorities of young Arabs and that of the banks led to insecurity and
anxiety. As a result, the Arabs resorted to withdrawal in emotional and physical contexts. The
study mainly focused on the variations of values and culture among Arabs and non-Arabs and
the existing tension the individual Arabs and the financial institutions.
According to Schuster and Copeland, (1996 as cited in Corbitt, Peszynski, Inthanond,
Hill, &Thanasankit (2004), Arabs tend to have more information about each other as compared
to Westerners. Schuster and Copeland (1996) , noted that culture of the Arabs allows for
networking extensively through socializing. The Arabs endeavor to make new and significant
connections in their daily lives. According to the study by Corbitt, Peszynski, Inthanond, Hill,
&Thanasankit (2004), the Arabic society tends to be tribal. The society highly values family and
loyalty. Among the Arabs, decision making can be influenced by social position, family links,
instincts and intuition and personal relations. In this respect, the Arabic culture dictates that

established relationships should not be broken. These concerns have extended to management
and business operations among the Arabs. For instance, in the banking transactions, Arabs tend
to stick with their initial banker rather than find a replacement. The study notes that the Islamic
tradition influences the tribal values of Arabs. The author’s further state that literature on Arabic
cultures coupled with observation resulted to the conclusion that the Arabic society tends to be
closed. It is believed that Islam can be considered as a comprehensive lifestyle. In order to
understand the business transactions in the Arab nations, one would need to understand religion.
Primarily, Arabs tend to be slow towards engaging with strangers. On the other hand, well-
grounded trust could be applied as a highly valued mechanism towards reducing uncertainty.
High levels of uncertainty avoidance exist among the Arabic culture. This aspect is replicated in
preference to follow rules and stable business enterprises. The Arabic culture enforces that
intrinsic uncertainties of life should be explained and minimized highly. Such cultures therefore
exhibit high significance on information security. In this culture, change occurs as a threatening
initiative. Therefore, Arabs tend to concentrate on relationships that simplify predictability and
interpretations of situations. Here, uncertainty avoidance defines the perception of individuals
towards unknown and uncertain outcomes. It cannot be minimized by calculable avoidance of
risk. Primarily, Arabs tend to give serious considerations when dealing with fellow Arabs. The
authors associate the Arabs with resilience in in-group preferences, loyalty and collectivist
cultures. These aspects come into play when dealing with services, people or products.
Conversely, they may be relaxed towards developing relationship with potential counterparts
from other cultures.
5.4.3 The Universal Approach towards Trust
Many studies on trust in communication exist. Initial studies were conducted among the
Greeks. Alternatively, recent studies tend to be multi-disciplinary spanning from marketing,
psychology, information security and sociology. Strategic studies of trust in marketing and
organizational behavior include Neal, Finlay, Catana, &Catana (2007), Khan and Khan (2015)
and Lauring&Bjerregaard, (2009). Khan and Khan (2015) focused on organizational trust while
as Neal, Finlay, Catana, &Catana (2007) and Lauring&Bjerregaard (2009) focused on trust in

social relationships. Trust is a prerequisite for building commercial and interpersonal
relationships. As cited in Catana, &Catana (2007), Lewicki and Bunker (1995), Ganesan (1994),
Ganesan and Hess (1997) and Baier (1986) , trust in relationships with a focus in social
psychology, sociology, economics, management and marketing and philosophy in that order. The
diverse aspects of trust in relationships further receive attention from disciplines of biology,
anthropology, finance, medicine and economics. These multi-disciplinary perspectives on trust
result in diverse outcomes on the same.
5.4.4 Openness to Communication
In the business field, communication can be classified as formal and informal. Also,
through communication, meaningful information can be conveyed on a timely basis. In this
respect, communication breeds trust. However, the aspects of openness and information sharing
constitute the antecedents of trust in communication. According to HöHmann& Welter (2005),
the multi-dimensional structure of communication constitutes willingness to communicate,
quality of communication and quality of feedback. Among the three, willingness to communicate
helps in developing trust. Therefore, openness occurs as an antecedent feature of trust.
Fundamentally, openness to sharing information can be regarded as a sentimental attribute of the
mind. Other studies that concluded that communication developed trust include Mukherjee and
Nath (2003) and Anderson and Narus (1989) as cited in HöHmann& Welter (2005). In
Mukherjee and Nath (2003), aspects of communication directly and positively impacted on the
relationship between a retailer and supplier in the tyre business. Moreover, the study noted that
communication directly relates with trust and sharing information. Another study;
Lauring&Bjerregaard (2009),argues that communication associateswith the interlinked nature of
industrial communication.Various studies like Chelune (1979),have been conducted towards
understanding the significance of openness in communication( Anderson, Baxter &Cissna 2004,
p.54).
5.4.5 Relationship on Sharing Information
Karahanna, Evaristo&Srite (2006) focused on the significance of frequency in open
communication. In addition, according to Gefen, Rose, Warkentin, &Pavlou (2008), many
aspects of communication and relationships arise in the field of business in high technology. The

authors argued that trust based on cognition and propensity did not outweigh affection based
trust. In this respect, openness in communication intensifies success and ultimately enforces the
growth of affection based trust. Trust derived from affection entails a capacity for understanding,
listening, openness, concern and care. In addition, the aspect of trust strongly breeds out of
positive emotional trust. It is based on undoubted liking towards the trustee. Emotional trust
tends to be open, receptive and loyal to its counterpart. Through emotional trust, individuals can
communicate confidential information between themselves. Through shared understanding in
communication, trust can be developed. It can also lead to establishing solid foundation in non-
opportunistic behaviors. In essence, communication can be effectively developed through, face
to face, clear, culturally sensitive, open, honest and timely communication. According to
Palaiologou (2007),trust in relationships can only be developed in interpersonal communication.
Also,Corbitt, Peszynski, Inthanond, Hill &Thanasankit (2004), concluded that face to face
interaction is vital in the initial stage of developing relationships based on effective
communication. In addition, Mooradian, Renzl&Matzler (2006),noted that partners in a business
setting needed high levels of trust. In this study, openness in communications is viewed as an
aspect that builds trust. Again, the study by Theron et al. (2008) is featured in this section as it
studies on clients and their managers in South Africa. The study concluded that reduction of
uncertainty and risk depended on effectiveness of communication between the two parties. In the
financial services industry, effective communication involved openness with adequate
information. In the study, respondent clients preferred that business values of providers aligned
with their own values. The study further concluded that fundamental antecedents of trust involve
shared values and similarity in cultures.
Abrams, Cross, Lesser & Levin (N.D.) studied the cross cultural industrial market
between the United Kingdom and Saudi Arabia. The study concluded that both countries highly
valued communication as a valuable aspect of developing dynamic relationships. The Saudis
emphasized on the sentimental elements of the dynamic relationship. Contrastingly, the British
emphasized on calculative and instrumental elements of dynamic relationship. In conclusion, the
study found that universally, openness in communication based on affection is likely to occur
between partners that share similar values. The similarity in values was considered as emotional
and effective antecedents of trust in communication.

5.4.6 Variables of Shared Culture, Environment and Values in Communication
Shared values
In the normal human interactions, high levels of trust significantly derive from the practice of
shared values. According to a research byPutnam &Nicotera (2009), the findings indicated that
shared values constitute the major components in building unconditional trust among diverse
experiences of individuals. Shared values fundamentally and inherently build the standard of
loyalty that is highly sustained among individuals in order to boost fairness and helpfulness.
Individuals that share a common value build their trust based on the particular single similarity.
In addition, the study noted that individuals tend to hold a perception that individuals that share
their significant value can be called upon for cooperation or certain obligations. The study cited
that (Tschannen-Moran, 2004) noted that individuals that comprehend each other’s
communication or expertise have higher likelihoods of developing closer bonds and mentality.
Another study by Ganesan and Hess (1997) argues that at a personal level, individuals with
similar experiences individuals tend to be highly likely to build trust. The similarity in
experiences and trust can be attributed that the subsequent intensification of comfort levels and
reduction of interpersonal barriers. In a study in the Emirati clients of a banking institution, the
study indicated that the similarity between bankers and clients significantly initiated empathetic
feelings. Additionally, this outcome indicates the significant role of shared values in building
trustworthy relationships. The study further cited that the study by Woodside and Davenport
(1974) made similar conclusions. Here, the relationships managers that held similar values with
their colleagues successfully gained more influence in changing opinions and attitudes of other
people. With reference to Ganesan and Hess (1997), the study noted that shared values could be
viewed as a multidimensional concept. This concept symbolized the degree to which a client and
banker share similar values in privacy, ethics and security of information. The study also
confirms that trust in relationships with clients could be viewed as an antecedent of trust. Such
trusts help in building and nurturing long term bonds in the associative relationships. In order to
have a relationship based on trust; bankers were required to exhibit a culture of ethics, privacy
and security of information to their clients. In the Arab nations, obligations, responsibilities and

roles are distinctly outlined. The shared understanding of expectations, norms, goals,
expectations and values promote the establishment and sustenance of strong trust based
relationships. For this reason, shared values comprise similarity of culture and reproduction of
behavior within similar cultures.
5.4.7 Style of Management in the Arab world
The study on culture by Hofstede unveils the antecedents of trust that form the basis of the
management style that is likely to be practiced. In the Arab world, little study has been
conducted concerning the management styles that are widely practiced. The worth of Arab nation
management styles therefore can never be accurately defined. It is widely perceived that these
nations practice strict forms of management as compared to countries in the European regions of
the United States of America. However, upon in depth study, the findings are likely to conclude
on the positive or negative aspects of Arab styles of management. Positive outcomes of
management include high levels of trust to share confidential information, willingness to share
knowledge, avoidance of misunderstandings and positive regard for Arabic culture. Fougère &
Moulettes(2006) conducted a study to determine the permanent style of management among the
Emiratis and non-Emiratis based on their similarity of cultures and values. The outcomes of the
study were classified based on the causal factors in shared values and culture and their impacts
on Arab management styles. Primarily, it is likely that the Arab management style exhibits
utmost degrees on social and corporate morality. They also practice openness to trade and
consultations in decision making. Foreigners living the Arab nations encounter diverse
consequencesassociated with diversity in national cultures.Fouler and Roulettes (2006),a critic of
the Hofstede study noted that cultures cannot be compared against each other while using
intellectual frameworks derived from ‘Western’ or modern aspects. Cultural factors significantly
come to play in underpinning the mediums of precursors of trust among the Arab cultures. Such
antecedents significantly determine the forms of relationships that arise.

5.4.8 Trust in Diversity
The paper titled 'E Pluribus Unum: Diversity and Community in the Twenty-first
Century,' by Putnam (2007) concludes that ethnical diversities hinder solidarity in the society.
Moreover, these diversities significantly contribute towards low levels of social trust. The paper
notes that these conclusions were made upon analyzing data collected form the United States.
Lancee and Dronkers (2007) further implemented Putnam’s study in Europe. In his 2007 paper;
'E Pluribus Unum: Diversity and Community in the Twenty-first Century,' Putnam comes to the
conclusion that ethnically diverse societies make social solidarity difficult and simultaneously
decrease social capital, and generalized trust is lower in these heterogeneous societies.
In his study, Putnam proposed three hypotheses using the contact hypothesis, conflict
theory and constricts theory in that order. First hypothesis stated that high frequency of
interaction among communities with diversity in ethnicity increased levels of trust. However,
this hypothesis considered that it would be confirmed only when applied to a group with a larger
population of the minority ethnic group. Second hypothesis noted that limited resources
ultimately results in development of in group solidarity or distrust. Thirdly, ethnic diversity
would lower trust both in in-group and out-group settings. Putnam tested these hypotheses in a
national research guided by the 2001 Social Capital Community Benchmark survey kin America.
The survey involved a sample size of 30,000 respondents collected from 41 communities
involving the Asians, Americans, Whites, Blacks and other. In a previous study, Putnam (1993)
noted that trust contributes significantly towards societal cooperation.
In the Western conceptualization, the construct of trust could be differentiated on the
basis of affection and or cognition. In a study by Chua, Ingram and Morris (2005) that aimed to
determine these two constructs of trust, the researchers noted that managers in America practiced
these two constructs widely. Traditionally, the surveys on professional networks measured the
diverse kinds of relations that the managers employ as they attend to various responsibilities
within the network. Such kinds of relations determine the nature and growth of friendship,
economic assistance, career advice and task advice. According to the study, the findings
indicated a definite overlap of these relations. The study noted that the overlap could be related
to the ease in alteration of interactions as the managers’ aim at maintaining different forms of

trust based relationships. Mainly, trust based on cognition was observed to be more likely to
grow in settings that provided financial assistance or professional advice. On the other hand,
affect-based trust developed significantly in friendship relations. In comparison, trust based on
affection differed from that of cognition on the grounds of ease to share confidential information.
5 .5 Western Information Technology
Transferring Information Technology (IT) to bring it into practice is difficult for many countries,
and they even fail to transfer it. The major obstacles that are faced while transferring IT into
practices are cultural and social norms of a developing country. It has been identified that in Arab
society the cultural beliefs of the people of various occupational groups differs on the basis of the
construct of the technology in their daily lives (Hill et al., 1998). From the study, it has been
observed that the transfer of technology and its influence varies from the Arab culture to the
Non-Arab culture (Hill et al., 1998). The main factor that is responsible for the technology
transfer in the Arab region and Non-Arab region is the socio-cultural factor. It has been analysed
that in Non-Arab Region, their social and cultural beliefs are the major factors that lead towards
successful IT in the region. However, in the Arab region, people prefer to deal face-face and
develop a family-like environment in their organisations, which mitigate the technology
interfaces (Hill et al., 1998). The traditional and religious beliefs of the people living in the Arab
region shows a resistance towards IT, especially their resistance is towards the IT aspects that
can influence the Arab culture. This influence can be in the form of less humane or change in the
perception of the employees with time.
It has also been examined that the cultural and social beliefs of the Non-Arab region get
dominated by the Arab cultural and social beliefs (Hill et al., 1998). Arab culture does not get
influenced by the external factors, such as level of education or technology exposure. However,
the people in the Arab region are ready for Information Technology Transfer (ITT). It can be
stated that ITT cannot transform the people within the Arab region into Westerners. In this
manner, it can be stated that, in order to bring ITT in the Arab region, a transfer process can be

designed as per the culture of the Arab region. Further, in order to reduce the mismatch, some of
the changes can also be made in the western culture regarding the information technology
transfer, such as bringing loyalty towards national traditions (Hill et al., 1998).
An article has focused on examining the Arab Culture, by testing the cultural-economic model in
order to gain knowledge regarding the international public relations (Al-Kandari & Gaither,
2011). It will also identify the cultural value orientations that affect the culture of the Arab
Region. It has been explored from the article that the cultural-economic model is effective in
analysing the Arab Culture, which emphasises on power, culture and their identity. Arab identity
and their language are influenced by their history and cultural indicators from past years. In this
essence, it can be stated that the people living in the Arab Region speaks Arabic language and
follows Arabic Culture. In Arab Region, there are various groups found, and all these groups are
not Muslims (Al-Kandari & Gaither, 2011).
Cultural backgrounds, it has been analysed that the people living in Arab Region tend to
follow Arab Culture and language, which creates a strong bond between these people based on
their culture. However, Non-Arab people living in the Arab Region feel difficult to manage with
the Arab people, due to language as their major barrier. It can be concluded from the
observations of the cultural-economic model that in Arab Region, their culture plays a significant
role in maintaining public relations, but in West different can be found (Al-Kandari & Gaither,
2011).

5.6 Attitudes affecting the information security behaviours
Although many organizations have deployed highly secured infrastructures to ensure a high level
of information security (Parsons et al,. 2014), the human factor is often overlooked in
information security considerations as a threat to protect their electronic data (Maconachy et al.,
2001; Dlamini et al., 2009) (Schultz, 2005). Information security by nature was more focused on
developing hardware and software network solutions. However, the large number of security
breaches highlights the importance of human behaviour towards information security. The
question is “what are the Personality factors that influence user’s attitude for more effective
information security awareness? And how customising security awareness training through better
understanding of personality trait can lead to more positive attitude towards information
security? ”(Schultz, 2005). Karjalainen (Karjalainen , 2011) stated that if computer users are in
possession of good knowledge about information security, this should result in more positive
attitude towards information security, therefore this should lead to more positive information
security behaviours(Karjalainen, 2011). However, security breaches committed by hackers with
solid knowledge of information technology seemed to indicate that good knowledge does not
necessarily lead to good or desirable behaviour. Another example is breaches committed by
insiders who have high level of technical knowledge do not support the statement mentioned
above.
Human behaviour is non-uniform when it comes to different impulses (locke, 1991). It is critical
to understand the different ways user’s response to various methods used to enhance information
security awareness. Applying security awareness methods on unplanned way may increase the
negative aspects of information security awareness (Siponen, 2000).
In July 2007, the Human Aspects of Information Security and Assurance (Pro. Clarke & Pro.
Furnell, 2014) stated in the “conference concept” for the inaugural international conference at
the university of Plymouth, United Kingdom that security requirements commonly
acknowledged that information security can’t be addressed by technical means alone and the

aspects of protection significantly comes down to the awareness, attitudes, behaviour, and the
capabilities of the involved people. The successful security strategy can be achieved by ensuring
appropriate attention and support for the user’s needs and this should be seen as a vital element.
In 2014, a study of information security awareness conducted in three different Australian
Government Organizations aiming to show how these three dimensions Knowledge, Attitude,
and Behaviours results can be linked to each other (Parsons, McComac, Pattinson, Butavicius, &
Jerram, 2013). The behaviours of end user have been referred to by Stanton (Stanton, R.stam,
Mastrangelo, & Jolton, 2005) as naïve mistakes as the following:
Good behaviours (deliberate).
 Always log off when computer unattended.
 Refuse emails from unknown or untrusted source.
 Use software with valid license.
 Shredding or destroying confidential documents that needs to be disposed.
Neutral behaviour (accidental)
 Share user name and passwords.
 Open untrusted emails attachments.
 Access suspicious websites
 Leaving workstation unattended
 Not reporting security breaches or incidents
 Leaving media devices such as DVD, USB that contain sensitive information on desks
Bad behaviours (deliberate)
 Hacking into other user’s accounts
 Sending and creating spam emails
 Downloading files and video through peer-to-peer file sharing
 Configuring wireless gateway to give unauthorised access to company network
(R.Pattinson & Anderson, 2007)

In 2009, D., Sim,I, Liginlal; L, Khansa (D. & L, 2009) suggested that neutral behaviours are
responsible for many human errors therefore; their research was focused on these behaviours to
develop a web-based questionnaire which was sent anonymously via email to these
organisations and it was complemented with interviews with the senior management. Results
were recorded as following:
In organisation A, 123 out of 222 participants completed the survey resulting in 55% as response
rate. In organisation B, 52 out of 200 participants completed the survey resulting in 26% as a
response rate. In organisation C, 28 out of 746 participants completed the survey resulting in 4%
as a response rate (Parsons, McComac, Pattinson, Butavicius, & Jerram, 2013).
As results, organisation C was found very low comparing to other organisations which greatly
affected the overall findings. Fowler claimed that those employees who choose to answer the
questionnaires are likely to be self-selected participants (F.J, 2002). This means that those
participants are most likely to have an interest in the topic in question considering small sample
sizes. This means that the level of information security is lower than the estimated level in their
study.
The web-based questionnaire was developed around eight aspects of information management to
provide more in-depth context-specific information as following:
1- Importance of information security policies
2- Principles of information security policies
3- Rules of information security policies
4- Password management
5- Email and internet usage
6- Reporting security incidents
7- Consequences of behaviour and training.
These focused areas were chosen to allow researchers to identify any weaknesses within the
information security so this can addressed subsequently by the management in the form of
training, communications, and policy development for example, questions were asked the
participants about their understanding of information security threats and the experience with
security awareness training within their organisation. Moreover, questions were asked about their

general computer use and practices, results were used to measure each focused area along with
the three dimensions: knowledge, attitude, and behaviour.
Allen Edwards, University of Washington, 1953 (Edwards, 1953) stated that the response bias
and desirability bias have influence on the self-report questionnaires, this means when
participants select the same answer to every question it is observed as a response bias while
social desirability bias is observed in a way that ensures they are seen to be behaving suitably.
D., Sim,I, Liginlal; L, Khansa (D. & L, 2009) stated that these kinds of behaviours can be
detected and eliminated therefore; negatively worded questions were decisively included in the
design of this questionnaire to avoid such things.
Overall results of this web-based questionnaires at three different organisations (Parsons, K.,
McComac, A., Pattinson, M., Butavicius, & Jerram, C. 2013) which were assessed using three
dimensions, namely, knowledge, attitude, and behaviours were found high. The study has
described overall comparisons of the three organisations but not between them. In addition,
interviews were conducted with members of senior management which revealed that they have a
good knowledge and understanding of information security awareness of their employees.
However, they acknowledged that some areas of interest and concern needs more appropriate
education such as using social networking sites whilst at work. As a limitation that was found in
this research all results were gathered based on self-report which doesn’t reflect accurate or true
attitude and behaviour as mentioned above , some respondents could be influenced by biases
such as social disabilities bias which was explained above. These respondents may deliberately
or un-deliberately answer in a way that ensures that they are presented in a positive light
(Edwards, 1953). On the other hand, Schmitt & Spector (Schmitt, 1994; Spector, 1994) stated
that self-report can appropriately measure individual’s perception, attitude, and knowledge.
Furthermore, they stated that the chance that employee’s responses about information security
awareness were open to further decrease the influence of this bias as they were informed that the
survey was conducted anonymously. Nonetheless, this study suggested that any future remedial
action should be directed towards information security program that focuses on improving the
policy compliance that focus on changing the participant’s behaviours. However, the positive
results of this study by applying the same approaches and techniques could have undesired
results when considering the culture of other countries such as Middle East as IT technology is

predominantly in English so most people in this region have English issue as a barrier especially
when it comes to IT security. Moreover, the culture is based on trust which affects the overall
user behaviour. In some cases, awareness programs are either weak or even non-existent.
People’s ability to follow written instructions as well as other organisational capabilities in this
region cannot be compared to those of users in western countries.
Eyong B. Kim, University of Hartford, 2013(B. Kim, Eyong, 2014) has developed a
questionnaire to investigate the attitude towards information security awareness and to
effectively build an information security awareness training (ISAT) for college students. He
stated that information security in educational institutions has been number one or two on the
potential to become more significant in the future as the use of information system and
technology grow. He also highlighted that so many reasons why it’s important to protect their
information and systems from possible security breach such as taking online courses, using
portable devices, using emails, accessing social networks, and PCs based on EDUCAUSE
survey, the top-ten in IT issues {Ingerman, 2011 #28}(Ingerman and Yang, 2011). According to
report presented by Data Breach Investigation (DBIR, 2011) it was reported that 83% of security
attacks are a target of opportunity rather than of choice, this means that the weaknesses of most
victims were identified because they exhibited a vulnerability that their attackers could exploit
and it refers to opportunistic attacks. Therefore, students need to know how to effectively protect
their information to prevent the opportunistic attacks.
Eyong B (B. Kim, Eyong, 2014) stated that, according to National Institute of Standards and
technologies (NIST SP 800-16, 1998) there are three keys to address the human factors and
competencies in information security, awareness, training, and education. It’s been stated by
NIST that every individual in any organisation should have security awareness, security basics
and literacy, this is considered as a stepping-stone between the training and awareness as it
provides a better foundation knowledge, i.e. security terms and concepts, for further security
awareness training. The main aim of IT security awareness training is to change security attitude
among employees and therefor to change the organisational culture (NIST SP 800-16, 1998).
Okenyi and Owens stated that the success rate of hacking attacks reduction at both level
individuals and organisation depends on the security awareness training, it’s important to focus
on how a user can exhibit a continuous secure behaviour (Okenyi and Owens, 2007). Siponen

has stated that when an organisation develops a well-documented security guideline to address
awareness; it is unsuitable approach when it is simply presented in a factual manner (Siponen,
2000). In addition, he said that the education program and end-user training in order to be more
effective, it should have end-user buy-in and be easily accessible.
Two approaches have been suggested in ISAT paper (B. Kim, Eyong, 2014) one is to determine
if the fear of sanctions will control whether users comply with information security policies
referred as “sanction-based approach” so the actions of information security can discourage users
from potential computer abuse by committing security violations (Straub, 1990; Siponen et al.,
2007). The other approach which was the main focus of ISAT paper is the information security
awareness training for student colleges referred as education approach (Siponen, 2000).
Gardner (Gardner, 2004) stated that users should internalize the reasons why it is important to
comply with information security policies as the main goal of this awareness training program.
In addition, training is an appropriate intervention methods in the improvement of human
performance model (HPI) when the problem root is those individuals who are lacking of
knowledge, skills, and attitude (King et al., 2001).
Puhakainen and Siponen stated that training program has a limited value because it doesn’t work
in practice therefore, an empirical proven approaches is needed by IS security practitioners to
improve compliance (Puhakainen and Siponen, 2010). Vincent and Ross suggested that planning,
organising the training, implementing, and evaluating and follow-up are the four steps for
effective training (Vincent and Ross, 2001). These four steps are explained as following:
Phase Contents
Planning The need assessment, promotion of the
training program, and selection of trainer
Organising Training
Specified objectives, instructional strategies,
learning theories, lesson plans, course
notebook or manual, and training program or
curriculum
Implementation Learning during the implementation by,
presentation, explanation and interaction

between the trainees and trainer.
Evaluation and follow-up This phase will evaluate the accountability
and proactivity improvement.
Figure 1: Four steps for effective training (Vincent and Ross, 2001).
Goldstein, Ford, Sleezer, Zemke stated that these four steps can be more effective training
program by conducting a systematic need assessment that is a crucial initial step to the design
and development of the training (Goldstein, Ford,2002; Sleezer,1993; Zemke, 1994). Moreover,
information security objectives should be investigated to determine if the training can address its
problem to meet these objectives. In more details, when doing so, organisation often conduct
needs assessment which includes three-steps process as following:
Process Contents
Organisational analysis
This process focus on questions such as,
which organisational goals can be attained
through personal training? And where
training needed in the organisation?
Task analysis
This process covered, what training materials
that trainee must learn to perform the job
effectively?
Person analysis Finding, who the targets are for the training
program?
Figure 2: Need Assessment three-step process (Goldstein, Ford,2002; Sleezer,1993; Zemke, 1994).
The National Institute of Standards and technology (NIST, SP 800-5, 2003) suggested 27
information security awareness topics, only 17 topics out of 27 have been selected to be
investigated as an educational approach for student collages training study. These topics cover
the following aspects:
1- The need for Anti-virus software
2- Updating virus definitions
3- Regularly scan a computer and media devices such as USB, and external storage devices
4- Personal Firewall use

5- Software patches installation
6- Risk of downloading programs or files
7- Risk of peer-to-peer file sharing
8- Risk of emailing password
9- Risk of e-mail attachments
10- Risk of clicking on e-mail links
11- Important files backup
12- Risk of smartphone viruses
13- Anti-virus software for smartphone
14- Strong password characteristics
15- Use of different passwords for different systems
16- How often you change your password
17- Use pop-up blocker
The ISAT paper research stated that students’ perceptions of safety in information security
might be different from each other and it depends on their ISAT experience.
A questionnaire survey has been conducted on undergraduate and graduate students with total
number of 357 students in medium size University in New England. The questionnaire was sent
as an email attachment by third party followed by a reminder email in a week later. All results
were collected anonymously without any identification. As a result of responses, 70 out 357
students returned the survey scoring 19.6 percent as return rate. Two responses were deleted as
there is no specific answer if they have had ISAT or not. IBM Statistical Package for the Social
Sciences (SPSS) has been used to analyse the remaining 68 responses.
Based on NIST SP 800-50 report (NIST, 2003), literature and theoretical standpoints, the author
has developed a questionnaire to investigate the attitude toward information security awareness
that has 27 items for undergraduate and graduate students in a business college. Five of these
items were for demographic information related to the respondents and one related to ISAT.
These six questions aimed to utilize the categorical variables to form the following questions:
1- The year of school
2- Working status

3- Gender
4- Age
5- Major or degree
6- Question whether students have taken the ISAT program recently.
18 items examine the attitude of students toward information security using a five-item Likert
scale (the most widely used approach to scaling responses in survey research) and the rest of
three items were used to determine if there is significant relationship between ISAT and the
students’ perception of safety in information security or not.
According to McLean (McLean, 1992), selling information security to people through campaigns
could in theory prove very useful in terms of security education as this is considered as an
approach to increase awareness and it is a positive motivation for information security since
campaigns have been seen as measures to improve attitude.
Parson, McCormac, and Marcus, 2011(Parson et al., 2011) stated that many people are too
trusting and have a habit to trust by default. Furthermore, employees can expose themselves and
their organisation often to potential security vulnerabilities associated with the use of social
networking sites. Many users failed to recognise that the information they revealed on network
sites could be used by malicious people with the intentions for nefarious purposes.
According to Acquisti and Gross (2006), people often reveal too much information on social
networking sites, and the impact on behaviour when it comes to the privacy concerns are little. A
study conducted based on 500 participants revealed that there was no relationship between self-
reported privacy concerns and the tendency to reveal personal information (Acquisti & Gross,
2006).
Furthermore, studies have revealed that most people have a limited understanding of the
consequences associated with the security risks or they don’t consider the security and privacy
implications (Acquisti & Gross, 2006; Krishnamurthy & Wills, 2008).
Stanton, Stam, Mastrangelo, and Jolton (Stanton et al., 2005) stated that even though awareness
is essential for involving end users in security efforts, the compliance with information security

policies is not guaranteed. Motivation of users is equally important to incorporate security
culture. As security is a secondary goal of end users, they have been seen not always motivated
to behave in a secure manner (Krekelbert and Sasse, 2005)
According to Schneier (2000) research (In secrets and Lies), he delivered verdict on information
security behaviour “Mathematics is logical; people are erratic, capricious, and barely
comprehensible.” In contrast, the research suggested that the behaviour of information security
possibly will certainly be understandable, organised, and meaningful for those who work making
sense of it (Schneier, 2000).
A Research conducted by Stanton, Stam, Mastrangelo, and Jolton (Stanton et al., 2014) presented
an effort to catalogue, characterised, organised, and analyse a range of user security behaviours
in corporations. Six elements taxonomy of security behaviour were developed that varied along
two dimensions: intentionality and technical expertise. The intentional dimension captures
whether the behaviour was malicious or beneficial while the technical expertise captures the
degree of knowledge or skills needed to have in order to perform that behaviour.
Figure 3: Map of average ratings for behaviours (Stanton et al., 2014)
As shown in the diagram above, the six elements categorised the security behaviours and
arranged along with the two dimensions mentioned above. The “awareness assurance” refers to
positive security conducted by users with good training. The “Detrimental misuse” refers to
intentional behaviour of users with minimal technical expertise. The “Dangerous Tinkering”
refers to behaviour with technical expertise and without intention to harm the business. Stanton,
Stam, Mastrangelo, and Jolton suggested that the improvement of security performance might lie

in shifting the enactment of the naïve mistakes behaviours toward the enactment of basic hygiene
behaviours with a small increase in security expertise (awareness).
ALBRECHTSEN, E. & HOVDEN, J 2010, stated that several organizational researchers
argue that bringing in local knowledge through processes that involve employees is both
necessary and efficient in order to accomplish or attain all kinds of changes related to security
awareness within organization (ALBRECHTSEN, E. & HOVDEN, J. 2010). It is necessary to
emphasises the importance of employee participation for improving employee’s information
security awareness and behaviour. The intended intervention of Albrechtsen and Hovden study is
to improve information security awareness and behaviour among the intervention participants.
On the hand, inviting employees to share their experience and thoughts on information security
as well as listen to security professionals within the organization in a small group was expected
to result in changes in both behaviour and awareness in Albrechtsen and Hovden study. The
interaction between security officers and employees by sharing experiences and knowledge is
important for information security work, since it creates a common insight among employees.
However, Albrechtsen and Hovden, 2007, observed that while the effects of employee
participation on organizational development and change are known within several research
traditions, this knowledge is not widely discussed in mainstream standards and guidelines for
information security (Albrechtsen and Hovden, 2007).
5.7 Personality Factors effects on attitude towards information security
The term personality is defined as a pattern of characteristic thoughts, feelings, and behaviours
that distinguishes one person to another (Phares, 1991).It is also been defined as a sum of
biological based and learnt behaviour which forms the unique responses of people to
environmental stimuli (Ryckman, 1982). The structure of personality is fairly stable and can be
predicted throughout different time and conditions. However, personality traits have different
depth and significance such as innermost layer and outermost layer. The innermost layer is the
basis while outermost is situation-bound that depends on situation. For example, a person who

feels tired will behave accordingly which doesn’t reflect the real personality of that person and
that is resulted from tiredness (Cattell, 1950). Personality is an important psychological
mechanism which guides behaviour (Phares, 1991). Everyone has a unique pattern of feelings,
thoughts, and behaviours that is formed by a fairly stable combination of personality traits.
Attitudes and behaviors are likely seen to be influenced by personality traits as personality forms
an inclination towards certain characteristic responses in any given condition (Heinströ m, 2003).
Age and maturity have an impact on the expressions of personality (Costa and McCrae, 1980).
Through the centuries, a range of theories and models have described the personality (for
example Freud, 1996 and Jung, 1986) seek to clarify the dynamics of personality as a whole. The
notion of different levels of consciousness was one of the basic concepts presented in Freud’s
theories. The theory of three levels of consciousness stated that “we are aware of the phenomena
on the conscious level, able to reach the pre- conscious but unaware of the Unconscious level
issues”. Personality and reactions are influenced by all these levels (Freud, 1996). However,
individuals are unique which makes it impossible to predict the reactions with certainty due to
the complexity system of individuals character (Bouchard, 1997)
Throughout 50 years of personality research, five basic dimensions of personality have been
commonly agreed upon (Revelle and Loftus, 1992). These dimensions were found to be used to
describe differences in cognitive, affective and social behaviour. Based on previous personality
scales, these dimensions are: Neuroticism, Extraversion, Openness, Agreeableness, and
Conscientiousness (Costa and McCrae, 1992).
Revelle and Loftus, indicated that these dimensions are stable through a lifetime and seem to
have physiological base (Revelle and Loftus, 1992). The evolvement of the five-factor model
was originated from the analysis of the terms which was used to describe the personality
(Goldberg, 1990).
Since these factors have become a robust taxonomy of personality (digman, 1990), then
understanding these personality factors dimensions and their effects towards attitude may lead us
to more effective responsiveness of users towards information security awareness. To extend
more on this research, this study intend to examine these five factors separately as they may
relate to the effect of attitude towards the responsiveness of users towards information security

awareness training. So hypotheses for the relationships of these factors with attitude towards
information security are proposed for each factor as below.
5.7.1 Neuroticism
The term neuroticism is a measurement of affect and emotional control where low level of
neuroticism indicates that person is emotionally stable unlike person with high level of
neuroticism which indicates an increasing of negative emotions experience (Howard and
Howard, 1995). Since “Neuroticism reflects person’s tendency to experience psychological
distress” (Ross et al., 2009), is it expected that a person with high score in neuroticism would
have negative emotion towards information security awareness training? Do people with high
neuroticism present higher risk? If yes then, more focus is needed for this type of personality.
Previous studies have shown a significant relation between personality and attitude such as
information seeking behaviour (see Heinstorm, 2003). People with high level of neuroticism tend
to have feelings of being anxious as a result of being put in stressful situation (see Revelle, 1995;
Costa and McCrae, 1992). It was noted that in particular people with high emotion instability
experienced lack of time as barrier when seeking information for example a research students at
the university seeking information in the library database (Heinstorm, 2003). In the other hand,
the research has shown also that performance by people with high level of neuroticism drop in
stressful situations (Costa and McCrae, 1992).
People with high level of neuroticism are more vulnerable to the strain of many conflicting
messages and prefer less confusing information. Therefore, it is expected that there is an inverse
relationship between accepting information security training and neuroticism. However,
customising the training by making it simple, relevant, short and less timed, could possibly give
positive results. This is a way of increasing control and confidence for
Self-doubting persons so the more secure they are the more active and able to accept new
information as well as accepting information security training.
H1: There is an inverse relationship between neuroticism and acceptance of information security
training?

5.7.2 Extraversion –Introversion
The extravert person tends to be physically and verbally active while introvert person is likely to
be more independent (Howard and Howard, 1995). Extraverted people have an enthusiastic,
active, and confident character for example students seeking information wanted to find more
information without being methodical in their search for it (Heinstrom, 2003). This reflects their
attitude toward information seeking behaviour as energetic and outgoing students. Previous
research has shown a common resistance to “bother” librarians with information queries
(Onwuegbuzie and Jiao, 1998). However, this unwillingness is improbable to restrain outgoing
students as a social interaction is an important part of their information behaviour.
However, people with high extroversion tend to have big influence on others which could be a
positive or negative in IT security for example “Leaders” or senior management.
H2: there is a positive relationship between extraversion and the responsiveness towards info sec
training?
5.7.3 Openness
The term openness or openness to experience is a measure of people’s imagination such as depth,
breadth, and unpredictability (Howard and Howard, 1995). Those people are open to new idea,
have cultural interest, educational aptitude and creativity. However, people can have different
level of openness reaction. High level openness people are open minded, have deep interests, and
like novelty while low level people tend to be traditional, conservatives, and prefer familiarity
(Howard and Howard, 1995). How openness affect user’s willingness to follow information
security guidelines?
H3: There is a positive relationship between openness people and the willingness to follow
information security guidelines?

5.7.4 Agreeableness
Agreeableness is a scale that is linked to altruism, nurturance, emotional support and caring
(Howard and Howard, 1995). People who tend to have low level of agreeableness are
competitiveness, hostility, selfish, and jealousy. In the other hand, people with high level of
agreeableness are gentle, kind, and warm (Costa and McCrae, 1992).
Knowing person with high agreeableness, should we expect such a person to have the highest
level of acceptance of information security awareness and improvement of awareness?
H4: There is a positive relationship between agreeable person and the level of acceptance of
information security awareness?
5.7.5 Conscientiousness
People with goal-directed behaviour are measured by the level of conscientiousness and it is
linked to educational achievement or to the will be achieved (Howard and Howard, 1995).
People with high level of conscientious are more competent, dutiful, orderly, and responsible
(Costa and McCrae, 1992).
Based on the term defined above, would it be reasonable to expect the person with high level of
conscientiousness to be more willing to learn and follow information security training with
minimal awareness training? Since the person is dutiful, and competent does he or she need
awareness training? Would brief training be sufficient for this type of personality?
H5: There is a positive relationship between conscientious person and the acceptance of
information security awareness training?
5.8 Personality traits, Information sharing, and Trust
Sharing knowledge and enabling the knowledge creation is essential to innovation and the
managerial success (Nonaka and takeuchi, 1995; Spender, 1996; Von krogh et al., 200). The fear
of criticism and the fear of misleading others can inhibit knowledge sharing (Ardichvili et al.,
2003). Therefore, it is important to understand the factors that hinder knowledge sharing in
particularly at the individual level aspects. Recent researches have not established a connection
between knowledge sharing and contemporary theories of personality (Mooradian et al., 2006).

However, they addressed that need by explicating and testing of a model linking that covers the
understanding of the hierarchical structure of the personality, interpersonal trust, and knowledge
sharing.
Personality has been found as an important factor that influences the behaviour of individuals
when it comes to sharing knowledge (Mooradian et al., 2006). The personality are best described
by the big five personality over years (Costa and McCare, 1992; Duff et al., 2004; Petrides et al.,
2010). Recent research presented a study aiming to understand the influence of personality
factors on individual’s attitude towards knowledge sharing and online entertainment at
University students (Mooradian et al., 2006).
People’s behaviours can be changed by targeting their assumptions, values, and beliefs. As
mentioned earlier, Parsons, McCormac and Butavicius (2014) stated that most users of social
sites are too trusting to a point that majority of them trust by default; thereby exposing
themselves and their organizations to numerous and serious security threats. Parsons and
colleagues found that a significant percentage of users of social networking sites assume that
they are adequately protected on these sites, hence fail to exercise the same degree of common
sense they would practice in the real world (Parsons et, al,. 2014).
Differences in people’s beliefs, perceptions and assumptions define how they react to
information-security threats such as spam emails from phishers; screen pop-ups; as well as
messages sent to them on social networking sites from unknown sources or from friends, but
containing questionable contents and tones such as asking for money or log-ins and passwords.
In addition, since individuals’ degree of assumptions and perception defines how they trust the
presented situations, persons with a tendency to trust sites and strangers easily are likely to set
weak passwords and expose their confidential information to the public (Abdel-Aziz, 2010), thus
making them more vulnerable to cyber criminals and hackers .
Human mental behaviours and functions (psychology) also play a leading role in protecting
confidential information of an entity and that of an individual. According to Abdel-Aziz (2010),
focusing on changing people’s behaviours through initiatives such as security awareness
programs can play an instrumental role in enhancing information security. Programs aimed at

changing people’s behaviours should focus on both cognitive psychology (a study of people’s
behaviours in relation to their reasoning, perceptions, and memory); and social psychology (a
study of people’s behaviours and mental processes such as peer influence). Abdel-Aziz (Abdul
Aziz, 2010) further suggests that programs that can help people change their Ideal Self to make it
more security friendly can significantly help in making network users adopt the relevant
measures to adequately protect their personal information.
Nowadays, Information security also became a major issue in social networking sites. Parsons,
McCormac and Butavicius (Parsons et, al,. 2014) highlighted that there are numerous security
vulnerabilities that are linked to the use of social networking sites. Nonetheless, studies have
shown that most users of social sites are too trusting to a point that the majority of them trust by
default; exposing themselves and their organizations to numerous and serious security threats.
According to Parsons, McCormac and Butavicius (Parsons et, al,. 2014), many users assume that
they are adequately protected on these sites, thereby failing to exercise the same degree of
common-sense they would practice in the real world.
People usually share a lot of information through social networking sites without taking adequate
measures to protect the privacy and security of the shared information. For example, a study
conducted by Acquisti and Gross (Acquisti and Gross, 2006) revealed that most of the social
sites users reveal information that criminals or persons with malicious intentions can use to
engage in a cybercrime. According to this study, about 22% of the interviewed users provided
their real home addresses, 40% publicly displayed their schedule of classes, 88% revealed their
dates of birth, with 40% of the respondents revealing their real phone numbers (Parsons et, al,.
2014).
Parsons and colleagues (2014) stated that the key factor that jeopardizes information security in
the social networking sites is the fact that a significant percentage of the users of these sites are
very trusting in relation to the persons they want to add as their friends. Studies conducted by
Rosenbury in 2005 and Sophos in 2007 (Rosenbury, 2005; Sophos, 2007) which involved
designing programs that would automatically send friend requests to social network users
revealed that about 94% of the users who accepted friend requests from the programs revealed
their personal information (Parsons et, al,. 2014).This loophole makes it easy for social

networking sites to be used for social engineering, a popular form of phishing in the modern
times.
3 Methodology chapter
Overview and structure
This chapter describes the experimental work. It begins by clarifying the research questions.
Moving forward, the second section then covers the approached methods, explanation of
research paradigm, research approach and mixed methods which will then be combined with a
relevant structural interviews and survey, research design and data collection method. It will also
include sample size and technique, pilot study, and research limitation.
3.1 Research Questions
Defining a research focus
The proposed plan of this research is to attempt to answer research questions by examining the
trust and culture through the lens of local Arab culture. Moving further, this research will extend
more on investigating the nature and the role of trust on inadequately sharing information as the
main focus of this research as found in Arab culture and whether this has something to do with
certain aspects of the cultural factors and if so, to what extent does culture affect attitude towards
trust. Finally, the research will seek to identify ways to reduce the gaps or the mismatch between
western based system and Arab local culture.
One of the vital cultural factors is trust. Existing research in this area seems to indicate that
members of Arab communities tend to have a high level of trust based on shared values, so
further research is needed to investigate possible ways to make adjustments to the level of trust
and therefore reduce the mismatch between western developed information system and the Arab
local culture. Since western’ culture has their own concepts, beliefs, and values about
information system and how it should be utilized, this therefore create what is called the cultural
challenges or obstacles when it transferred to Arab culture which then result in failure accepting

it within the Arab region. It is the intent of this paper to look at these cultural and social factors
within Arab region and examine these obstacles.
Research question 1
The differences between Arab trust and others
As revealed in the literature, trust in the Arabian culture is deep rooted and a central to functional
relationships. It is also idiosyncratic and with dynamics that are different to those found in the
west. This research examines the impact of Arab trust on IS related security behaviours.
Since the Arab trust is a rooted culture or perhaps something they live with it as cultural values,
then understanding the factors that result in such attitude may lead us to more effective
responsiveness of users towards information security or at least to better understanding of the
nature of Arab trust. To extend more on this research, this study intends to identify and examine
the nature of trust within Arab region. The first area of investigation this research will attempt to
address is, “Trust is rooted culture within Arab region. Trust can be dynamics
based on the relationships but leads to resistance behaviours towards western IS.
At some point consequences could result in when breaking cultural trust”
Research question 2
The impact of trust on Info sharing as found in Arab culture
As revealed in literature, sharing information within Arab region communities is a key to
establish trust between partners. According to Palaiologou (2007), trust in relationships can only
be developed in interpersonal communication. Also,Corbitt, Peszynski, Inthanond, Hill
&Thanasankit (2004), concluded that face to face interaction is vital in the initial stage of
developing relationships based on effective communication. In addition, Mooradian,

Renzl&Matzler (2006), noted that partners in a business setting needed high levels of trust. In
this study, openness in communications is viewed as an aspect that builds trust. According to
Lewicki and Bunker, (1996), Rempel, Holmes, and Zanna, (1985) and Lewis and Weigert,
(1985), trust in relationships is developed in different foundations. They range from empathy in
collective calculations, affective bonds, confidence in one’s counterparts and concern for
welfare. On the other hand, many researchers such as Bulter (1991), Zucker (1986) andCook &
Wall, (1980) attribute the growth of trust to the sharing of information with confidence of the
reliability and competence of the counterparts. The paper will seek to investigate and identify the
second area of research “Trust influenced by local culture. Trust dynamics scales
define the different level of trust, openness in communication between partners
contribute to building trust. Trust cannot be established without openness in
communication.
Research question 3
Mismatch between the western based information Technology.
In addition to language barriers, unique cultural values and customs in the Arabian region
contribute to the mismatch between western based IT and Arab culture. However, in the Arab
region, people prefer to deal face-face and develop a family-like environment in their
organisations, which mitigate the technology interfaces (Hill et al., 1998). The traditional and
religious beliefs of the people living in the Arab region shows a resistance towards IT, especially
their resistance is towards the IT aspects that can influence the Arab culture. This influence can
be in the form of less humane or change in the perception of the employees with time.This part

of the research will seek to identify ways to reduce the gaps between western based IT and Arab
culture by looking at the nature of culture and trust. Based on the above observation, the paper
will attempt to address and identify the third area of research related to the mismatch with
western as following “Transferring western IT Technology failed at some point due to
cultural differences which has not been taken into consideration.”
3.2 Methods and Approaches
Bringing some facts drawn from literature, an article has focused on examining the Arab Culture,
by testing the cultural-economic model in order to gain knowledge regarding the international
public relations (Al-Kandari & Gaither, 2011). It will also identify the cultural value orientations
that affect the culture of the Arab Region. It has been explored from the article that the cultural-
economic model is effective in analysing the Arab Culture, which emphasises on power, culture
and their identity. Arab identity and their language are influenced by their history and cultural
indicators from past years. In this essence, it can be stated that the people living in the Arab
Region speaks Arabic language and follows Arabic Culture. In Arab Region, there are various
groups found, and all these groups are not Muslims (Al-Kandari & Gaither, 2011).
It has been analysed that the people living in Arab Region tend to follow Arab Culture
and language, which creates a strong bond between these people based on their culture.
However, Non-Arab people living in the Arab Region feel difficult to manage with the Arab
people, due to language as their major barrier. It can be concluded from the observations of the
cultural-economic model that in Arab Region, their culture plays a significant role in maintaining
public relations, but in West different cultural backgrounds can be found (Al-Kandari & Gaither,
2011).
The research will began with a selected group of local Arab adults and a group of non-Arab
adults living in the same region. Subsequently, an interview will be conducted with some IT
expert within the Arab culture with structured open- and closed-ended questions as well as the

selected adults group. The selected group will be from different Arab countries speaking the
same language this will allow us to gather more data from different areas within the Arab region
and not only depending on one nationality. The reason why am going to do so is because the
behaviours of for example Kuwaiti or Saudis are not the same as other local Arab culture in
terms of personality and attitude as observed personally due to local economics factors.
Bringing western designed system and security procedure to a different culture such as Arab
region without considering their nature of local culture and local customs can lead to several
challenges such as resistance or low level of acceptance.
A qualitative and quantitative method will be used for the interviews and questionnaire. All
responses will be reported under thematic analysis section within the data analysis chapter. The
ultimate goal is to attempt to predict the success and failure of western based system as well as to
investigate the local culture behaviour and the nature of trust to improve the possibility of user
acceptance. Most researches have used English as a language of their pilot study. Since English
language is a barrier for our culture I will be using both language English and Arabic as most of
our people here is Arabic native speakers and some of them have good level of competency in
the English language so this should be a rational choice. However, the pilot study will be
conducted first using English version questionnaire; in case the questionnaire experienced some
invalid results then the Arabic version will be presented.
Due to the nature of Arab culture and beliefs, the research questionnaire will be conducting face
to face meeting using hard copy documents as the most desirable way in order to gather as much
as possible valid information which suites the targeted culture and increase the rate of
responsiveness. Interviews also will be conducted face to face.
3.3 Proposed methods
The first investigation this research will attempt to identify is;
“Trust is rooted culture within Arab region. Trust can be dynamics based on the
relationships but leads to resistance behaviours towards western IS. At some
point consequences could result in when breaking cultural trust”
The proposed method to answer the above research question will start by establishing the method

to be used. The method will consist of the following:
- Survey
- Awareness training experiment ( Phishing Email)
- Interviews with experts and face to face meetings with employees
The second research question we attempt to answer
“Trust influenced by local culture. Trust dynamics scales define the
different level of trust, openness in communication between partners
contribute to building trust. Trust cannot be established without
openness in communication.
The proposed method to answer the above research question will start by establishing the method
to be used. The method will consist of the following:
- Survey
- Analyze data of security breaches
- Interview experts on breaches
- Analyze the records of the walk-through data privacy misuse
The third area of investigation the research will attempt to address is “Transferring western IT
Technology failed at some point due to cultural differences which has not been taken into
consideration.”
The proposed method to answer the above research question will start by establishing the method
to be used. The method will consist of the following:
- Examine security procedures in the Arab culture through the lens of trust and culture
- What mechanism is being used? Are the effective?
- Examine western Information security Awareness Training
The method will start by designing trust scale and measuring participant’s beliefs about trust
and morality of other co-workers this scale should tackle all research questions. The

approaches of the structural methods and expectations to the problem of the local culture
have theoretical difficulties. The approach may provision a sanction system to force the
culture to change but this might cause more resistance to change as most employees have
mutual cooperation which makes it difficult in large group. To overcome these difficulties
the proposed method is to conduct this experiment individually so employees who stick to
mutual cooperation will cooperate individually instead of inducing other members answering
the proposed test. The questionnaire experiment will be conducted in groups no more than 4
person to ensure a valid responses.
The experiment should cover various factors such as public opinions, trust, compliance,
social trust, mutual cooperation.
The interest of this study has been fueled by observing accumulated evidence that show a rapid
growing that trust has an important role and benefits for the organization and their employees.
The experiment will contributes to the logical understanding of the Arab local culture and
different forms of trust as found in organization, and the antecedent conditions that produced
them.
General Trust scale
Description of measure:
The 6 items questionnaire below shows the general statements that measure the trust, beliefs ,
and honesty of others.
Scale:
Using the following scale, please indicate how much you agree or disagree with the following
statement:
1
Strongly Agree
2
Agree
3
Neutral
4
Disagree
5
Strongly Disagree

1) Most employees are honest.
2) Most employees are trustworthy.
3) Most employees are kind and good.
4) Most employees are trust to each other
5) I am trustful person
6) Most employees will respond in kind when others trusted them.
Scoring:
Each item is averaged together to form a continuous measure of generalized trust.
Description of Trust scale Measure
Questionnaire of 5 items designed to measure a general level of trust towards other
employees. It focuses on two different actors that form general trust: 1. the belief that
other people are honest and 2. Belief that trusting others are risky; these factors will
measure Anxiety scale and trust scale.
Motivational bases
The desire of being greed or fear of being idiot were the motivational bases that causes
not contributing to proper trust towards each other. These factors activated differently
based on the situations. When person being asked by strangers about certain classified
information, fear will have strong effect but trust is not, the other way around when the
same person asked for classified information from stranger the effect of trust is stronger
but fear is not, having said that this shows that friends within the same culture have
mutual trust among each other. However, once the stranger becomes a friend then

everything is changed therefore the stranger will inherit the mutual trust as a friend.
The networks of mutual cooperation relations play a significant role in Arab society in
comparison to western. It is predicted that the questionnaire responses will indicate the
issue presented in this study in terms of trust and related factors. The trust within Arab
society has been observed to help people to move out of mutual committed relations and
increased the trusting to other people in general, so the see themselves more honest and
fair and that in their opinion save their reputations as a culture committed people. The
study intended to present a solution to something can be called social dilemma or if not
found, categorize the possible solutions that explain the issue in more rational way. the
solutions can be categorized into three different comprehensive categories whether the
person is selfish so a need for strategic solution , the person unselfish so a need for
motivational solution, or neither of these categories of solutions which requires a change
in rules and considered as structural solutions.
Scale:
Please indicate in the following statement how much you agree or disagree with the
following statement:
1 Strongly Agree 2 Agree 3 Neutral 4 disagree 5 Strongly Disagree
1. People tell a lies when the can benefit in return.
2. Those dedicated to unselfish causes are frequently exploited by others.
3. Some people can do things well but because others pursue their own self-

interest and cooperation often fail because of them.
4. People are considered honest most of the time.
5. Community security system can affect the people work if developed further.
Scoring
Item 1 is reversed to item 4 which make up the same factor that people do
believe others are honest. Item 2,3 and 5 make up the trust to each other is
risky.
Trust in close relationship Scale
Description of measure:
A number of 17 item measure the level of trust in one’s relationship partner. Answers will be
based on 7-point Likert-type scale. The scale can be divided into sub-scale as following:
1. Expectedness
2. Trustworthiness
3. Belief
The following designed items will focus to penetrate through the way how employees thinking in
close relationship trust. Similar studies focused on changing the process and procedures of
certain guidelines and didn’t incorporate measures to test the way how Arab behave based on
rooted culture and lifestyle. The dominant behavioral controlled by local culture must be
expanded to include a covert processes or measures in order to get into the nature of trust as

found in Arab culture. Fear of shame can also influence the level of trust in close relationships
within the Arab culture and might affect the reputation of their values in the community and
result in misunderstanding between partners based on the way how they thing. Framework will
be presented to integrate expectedness, Trustworthiness, and Belief. Rather than reviewing failed
processes and procedures a need for examining the human psychological aspects based on the
nature of local culture can lead to more sustainable processes and user satisfaction.
Scale measure in close relationships
A designed point scale is presented to indicate the extent to which employees agree or disagree
to certain situations which is related to people who have close relationships with someone and
shows how the feel about it. The rating scale will be placed on boxes to the wright of each
statement.
Scoring description:
The overall result based on these sub-scales Expectedness item marked with E, trustworthiness
item marked with T, and Belief item marked with B will be combined to create overall trust in
close relationships.
Strongly Disagree Neutral Strongly Agree
-3 -2 -1 0 1 2 3
1. My coworker has proven to be trustworthy and I am willing to let
Him/her involve in actions which other coworkers find too threatening.
T
2. Even when I don’t know how my coworker will react, I feel
comfortable.
telling him/her anything about myself, including those things of which
I am ashamed. B
Though times may change and the future is uncertain, I know my
coworker will

always be ready and willing to offer me strength and care.
B
4. I am never certain that my coworker won’t do something that I
dislike or will embarrass me.
E
4. My partner is very unpredictable. I never know how he/she is going
to act from one day to the next day.
E
6. I feel very uncomfortable when my coworker has to make decisions
which will have impact on my personally.
E
7. I have found that my coworker is unusually dependable, especially
when it comes to things which are significant to me.
T
8. My coworker acts in a very dependable manner.
E
9. Whenever we have to make an important decision in a situation we
have never come across before, I know my coworker will be worried
about my welfare.
B
10. Even if I have no reason to expect my coworker to share things
with
me, I still feel confident that he/she will.
B
11. I can trust on my coworker to react in a positive way when I
uncover
my weaknesses to him/her.
B
12. When I share my problems with my coworker, I know he/she will
respond in a caring way even before I say anything.
B
13. I am certain that my coworker would not cheat on me, and there
was no chance that he/she would get caught.
T

14. I sometimes avoid my coworker because he/she is unpredictable
and I fear saying or doing something which might generate conflict.
E
15. I can trust on my coworker to keep the promises he/she makes to
me. T
16. When I am with my coworker, I feel safe in facing unknown new
situations.
B
17. Even when my coworker creates excuses which sound somewhat
unlikely,
I am self-assured that he/she is telling the truth.
T
Trust in People Scale
Trust is sometimes treated as a dependent variable; however, this can
systematically underestimate its relevance. The approach in this designed
scale establishes the importance of trust and its related measures of both
leaders and their employees. In fact, the feelings of dissatisfaction towards
leaders verses the employees themselves affected by trust so low trust helps
to create barriers which is difficult for leaders to success and vice versa.
Description of Measure
A designed questionnaire of 3 items presented to measure the level of people trust towards each
other. These items provide dichotomous choice. One of the items is the high trust response while
the other item is low trust response.
Scale:

1.) Generally speaking, would you say that most people can be trusted or that you can’t be too
careful in dealing with people?
(a) Can’t be too careful (b) Most people can be trusted
2.) Would you say that most of the time, people try to be helpful, or that they are mostly just
looking out for themselves?
(a) Look out for themselves (b) Try to be helpful
3.) Do you think that most people would try to take advantage of you if they got the chance? or
would they try to be fair?
(a) Try to be fair-minded (b) Take benefit
Scoring
The choices of 1b, 2b, and 3a considered to be high trust so each one gives respondent 1 point.
Western IT Technology system Satisfaction
Description of measures scale
A designed questionnaire focused on the satisfaction of using western transferred system within
Arab region. These items indicate the employee’s opinion about the simplicity or difficulties of
using western system.
Scale measure
A 15 items of two choices below indicate the user’s acceptance of transferred western system.
Options are given to include positive and negative aspects about using westren system.
1. Overall, I am satisfied with how easy it is to use this system

Comment strongly disagree strongly agree
2. It was simple to use this system Comment
strongly disagree strongly agree
3. I can efficiently complete my work using this system Comment
strongly disagree strongly agree
4. I am able to complete my work quickly using this system Comment
strongly disagree strongly agree
5. I am able to efficiently complete my work using this system Comment
strongly disagree strongly agree
6. I feel comfortable using this system Comment
strongly disagree strongly agree
7. It was easy to learn to use this system Comment
strongly disagree strongly agree
8. I believe I became productive quickly using this system Comment
strongly disagree strongly agree
9. The system gives error messages that clearly tell me how to fix problems Comment
strongly disagree strongly agree
10. Whenever I make a mistake using the system, I recover easily and quickly Comment
strongly disagree strongly agree
11. The information (such as online help, on-screen messages, and other documentation)
provided with this system is clear Comment
strongly disagree strongly agree
12. It is easy to find the information I needed Comment

strongly disagree strongly agree
13. The information provided for the system is easy to understand Comment
strongly disagree strongly agree
14. The information is effective in helping me complete the tasks and scenarios Comment
strongly disagree strongly agree
15. The organization of information on the system screens is clear Comment
strongly disagree strongly agree
16. The interface of this system is pleasant Comment
strongly disagree strongly agree
17. I like using the interface of this system Comment
strongly disagree strongly agree
18. This system has all the functions and capabilities I expect it to have Comment
strongly disagree strongly agree
19. Overall, I am satisfied with this system Comment
strongly disagree strongly agree
1 2 3 4 5 6 7 NA
List the most negative aspect(s):
List the most positive aspect(s):
PERCEIVED USEFULNESS 1 2 3 4 5 6 7

NA
1. Using the system in my job would enable me to accomplish tasks more quickly
comment
Unlikely likely
2. Using the system would improve my job performance Comment
unlikely likely
3. Using the system in my job would increase my productity Comment
unlikely likely
4. Using the system would enhance my effectiveness on the job Comment
unlikely likely
5. Using the system would make it easier to do my job Comment
unlikely likely
6. I would find the system useful in my job Comment
unlikely likely
PERCEIVED EASE OF USE 1 2 3 4 5 6 7
NA
7. Learning to operate the system would be easy for me Comment
unlikely likely
8. I would find it easy to get the system to do what I want it to do Comment
unlikely likely
9. My interaction with the system would be clear and understandable Comment
unlikely likely
10. I would find the system to be flexible to interrelate with Comment

unlikely likely
11. It would be easy for me to become skilled at using the system Comment
unlikely likely
12. I would find the system easy to use Comment
unlikely likely
1 2 3 4 5 6 7 NA
Questionnaire — People, Culture, and Leadership
This is not a test. There is no right or wrong answers. Answer how you personally feel about the
statement in your present job, not how you think it “should” be. Your answers are confidential.
Circle a number for each question.
1=No, 2=Mostly No, 3=Not Sure or Uncertain, 4=Mostly Yes, 5=Yes.
People
1 2 3 4 5 Do you feel valuable and creative?
1 2 3 4 5 Can you be inventive?
1 2 3 4 5 Do you see limitless opportunities for developments?
1 2 3 4 5 Do you know how you fit into the big picture?
1 2 3 4 5 Do you feel you belong?
1 2 3 4 5 Are you valued for your work and contributions?

1 2 3 4 5 Do you have exciting?
1 2 3 4 5 Are you well succeeded?
1 2 3 4 5 Are relationships at work mature and non-political?
1 2 3 4 5 Do you have enough information to make good decisions?
Culture
1 2 3 4 5 People bring their full energy and creativity.
1 2 3 4 5 Relationships and communications are fine.
1 2 3 4 5 senior managers seem to remember what it was like being an employee.
1 2 3 4 5 Power and control is widely shared.
1 2 3 4 5 I am engaged in decisions that affect me.
1 2 3 4 5 The company is open to challenges, suggestions, and change.
Leadership
1 2 3 4 5 Leaders here put people first.
1 2 3 4 5 Leaders here are good trainers.
1 2 3 4 5 Leaders here ask people how they can help them.
1 2 3 4 5 Leaders here set a clear direction — “This is where we are going.”
1 2 3 4 5 Leaders here recognize and reward preferred behavior.
1 2 3 4 5 Leaders here give everyone background information, the big picture.
1 2 3 4 5 Leaders here protect people from abuse from the system above them.

1 2 3 4 5 Leaders here make supportive, team decisions.
Mark with an X, any questions you would particularly like to see discussed in the group.
Please write any other comments and suggestions. Use the back of the page if you need more
space.
The score range is 0 to 3 where 0 indicate a very low trust and 3 very high level of trust.
Data privacy Method
1- Conduct a physical walkthrough of facility or office space to ensure Sensitive Personal
Data (SPD) and Personal Data (PD) are secured.
Items to look for during the walkthrough include:
• Unattended Smart Badges (login authentication method)
• Exposed SPD
• Unlocked cabinets with PD or SPD
• Unlocked laptops (should be configured to lock when SmartBadge is removed)
• Unsecured laptops or docking stations
• Keys in docking stations
• PD or SPD information on boards
• Unattended printed information with PD or SPD
• Unsecured keys for the cabinets
• Unattended flash drives, USB devices or other portable devices on desks / tables * Per CIRS
S502 USB removable media is prohibited, please refer to CIRS S502 for more details.
• PD / SPD on paper or devices thrown out in garbage cans or dumpster

*Make sure if an office is unlocked that you check the office for all of the above.
2- This is not a comprehensive list. Make a note of anything questionable.
• Laptops
• Not locked to docking station
• Keys for laptop left on desk, key slot or unlocked drawer
• Laptop left in unlocked cabinet not secured
• Secondary laptop not secured and left on desk, in cabinet, laptop bag
• Docking Station
• No cable lock
• Cable lock not secured properly to desk (ex: not wrapped securely around desk stand)
• Keys to cable lock left unattended (ex: left on desk or unlocked cabinet)
• Paper
• Containing PD/SPD (see the PD & SPD Definitions tab)
• Tablet/Notes with PD/SPD
• PD/SPD documents left on desk, in unlocked cabinet, printer area, recycle, trash area or in any
box or bag left unattended.
• Other Portable Devices
• Mobile phones
• USB, flash / thumb drives, backup hard drives * Per CIRS S502 USB removable media is
prohibited, please refer to CIRS S502 for more details.
• Boards/Whiteboards
• Containing PD/SPD (see the PD & SPD Definitions tab)

• Smart Badges (computer access badge)
• Should not be left on desk, in unlocked cabinet or in compute
• Should not have someone else's Smart Badge on desk or in unlocked cabinet (ex: admin,
manager/supervisor may have previous employee/contractor's badge)
• Personal Items - it is not a finding if an individual's own PD or SPD is exposed by choice
Definition of Sensitive Personal Data
Sensitive Personal Data (SPD) is a subset of Personal Data that has the potential of causing harm
to an individual and therefore requires heightened protection and care. SPD should only be
collected or handled when there is a specific legal, regulatory, or compelling business
requirement and may require registration with local Data Processing authorities. Specific country
and state legal/regulatory requirements define sensitive personal data, below is list of examples
of SPD:
• ID: Government identifier (social security number (SSN) or last four digits of SSN,
national ID number, passport number, driver license number or other government issued
identifiers )
• FIN: Financial data (credit/de bit card number; expiration data, card identifier
(CCV};bank account number; income or other financial information such as Retirement
savings accounts; credit application data)
• Individual taxpayer identification number
• Date of birth or age
• Race or ethnic origin (including tribal identification)

• Citizenship I Nationality/ Legal status in country
• Health Information -physical or mental health (including genetics); including health
insurance information (any unique identifier used by a health insurer to identify the
person or information related to a person' s application and claim's history)
• Religious / philosophical or political affiliation
• Trade union membership
• Sexual orientation I history
• Criminal history, law enforcement information or court record
• Military records
• Biometric data (finger prints, biometric images, such as retina scan, facial geometry,
DNA samples...)
• Account authentication credentials: User Name in conjunction with password or answers
to security questions; e-mail when combined with security questions or security tokens
• Data pertaining to children
Suggested discussion topics, depending on work:
● Email - encrypted when necessary, how to recognize and respond to scam emails?
● Shared drives / SharePoint - understand when to encrypt, how access controls work, when to
review and update?
● Sensitive Personal Data - do they work with any, understand the definitions and proper
protection?

● Personal Data - do they know how to recognize one and what to do?
● Paper - any documents with SPD or sensitive personnel information? - filed securely, disposed
of properly?
● Privacy incidents - do they work with any, understand the definitions and proper protection?
● USB sticks / thumb drives / external hard drives - understand these media devices are
prohibited and should no longer be used or under what circumstances there may be exceptions.
3.3 Rational selection for methodology
The research methodology is considered as an essential phase of a research study because
it undertakes tools and techniques which help in conducting the research study in a correct
direction and in a logical manner. Based on the topic and subject area of the research study, the
researcher conducts the study and chooses the best suitable methods for gathering information
regarding the study (Supino and Borer, 2012). In this research study, the aim is to identify how
attitude and responsiveness towards information security awareness training are influenced by
various factors including personality characteristics, local cultural values and trust in Arab
Region. Further, the objectives with respect to the research aim focus on investigating the factors
that influence human behaviours towards information security training, namely the five factors
included in the model of personality. Secondly, the impact of trust in Arab culture towards
information sharing as well as information security awareness training responsiveness is
investigated. The next objective of the researcher is to build a framework for a customised
information security awareness training (ISAT) based on the findings of this research in the area
of the personality and local culture factors. Further, the research focuses on identifying the
changes to western-based information security awareness training to reduce the mismatch with
local Arab culture.
It is essential that the researcher links the methodology with the literature review chapter
so that data collection can be done based on the research area and the aims and objectives
developed regarding the research topic (Sekaran and Bougie, 2010). It also helps the researcher

in providing justification for using certain methods to conduct the research study. The literature
review conducted in a research study is considered as a state of the art which enables the
researcher to include information regarding the research topic from various literary sources. It
can also be said that the literature review provides a focus on the subject of the study and covers
each of the component, in order to conduct the study efficiently (Sekaran and Bougie, 2010).
It can be said that research methodology chapter is significant in this research study as it
will help in designing a method for the main research problem identified in the study. It will also
examine the characteristics of the research study by applying scientific methods to get to the
conclusion easily (Supino and Borer, 2012). There are certain characteristics of a research study
which are fulfilled using appropriate research methodology. These characteristics are, logical,
systematic, reductive and empirical. With the help of research methodology, a research can be
carried out in a systematic manner by collecting the relevant information as per the research
topic. Further, research methodology carries out the study by deriving a logical conclusion and to
carry out the study; empirical methods are suggested using the methodology section of the study
(Supino and Borer, 2012). Another main advantage of using research methodology is that it helps
the researcher in explaining the concepts regarding the research study, which helps in further
getting to the conclusion. Therefore, in this research study, all the four characteristics are
considered for making the study effective (Supino and Borer, 2012). In this essence, it can be
said that the following chapter consists of various sections which help in conducting the study
properly. Firstly, an overview of Arab region is provided which will help the researcher in
getting an insight into the Arab region and the people living in that region. The overview will
further include three aspects covering the Arab region to gain an understanding of the research
area that is the personality of general people, trust among the people and their culture.
The methodology section further describes the research paradigm which helps a
researcher in getting a wider perspective on the research study and conducts the study in a
correct direction (Kuada, 2012). Therefore, it can be said that with the help of information is
gathered regarding the research study will help the researcher in answering the research
questions of the study. Further, another important section of research methodology is research
design, which is required in a research work, in order to provide a structure to the study (Kuada,
2012). The research design is important in a research study, as it mainly helps the researcher in
collecting the information relevant in the research study as per the research topic, assessing the

information and then analysing it. Further, in a study, qualitative, quantitative or mixed research
methods can be used to collect the information (Kuada, 2012). Research methodology chapter
further describes research approach, which is mainly used in analysing the collected information
so that knowledge can be generated by the researcher to get to the conclusion easily (Kuada,
2012). Data collection methods are also essential for achieving the aims and objectives defined
in the study by using proper tools and techniques defined in the research methodology (Kuada,
2012). The methodology also provides a rationale for using different tools and techniques in this
research study so that evidence can be provided for using the tools and techniques in the study to
get to the conclusion. The data collection is done in phases which are also described in the study
with their rationale and methods, so that reader can easily understand the data collection process
of this research study (Kuada, 2012).
3.4 Research Paradigm
Research methodology consists of an essential part; that is research paradigm. Research
paradigm is considered as important because it helps in conducting the research successfully by
providing a bigger and wider perspective about the research topic (Levers, 2013). It also includes
a set of practices, beliefs, and views that guide the research study towards successful completion.
Research paradigm consists of a framework that helps in gathering academic ideas and scientific
ideas, views of researchers and beliefs of the researchers to conduct the research study and get
some knowledge out of it. The beliefs and assumptions included in research paradigm are the
views and studies of different researchers (Levers, 2013). Research paradigm used in a research
study can be defined as a process or a specific way in which a researcher thinks to conduct the
study with a certain set of rules. Research paradigm also helps in giving direction and foundation
to a research work which can be considered as the primary step of a research study, in order to
get to the conclusion easily (Levers, 2013).
Research paradigm helps in the research work to develop the research design in
accordance with the nature of the research study. It can also help in choosing the methodology
for the research while conducting the study (Levers, 2013). Moreover, it can be said that research
paradigm helps in designing a structure for the research study in order to select data collection
method to answer the research questions appropriately. Thus, it can be said that research
paradigm reflects the views and perception of people from the world we live in. In the views of
Howell (2012), research paradigm is considered as a technique, which helps in conducting the

research study in a correct direction by providing a structure. Research paradigm also includes
the beliefs and perceptions of the researcher which guides through the research study and
integrates various factors to conduct the study in a correct direction (Howell, 2012).The
assumptions and considerations that are made in the section of research paradigm helps in
deciding the research design and methods that will help in conducting the study successfully.
Researchers mostly focus on these assumptions and considerations, which has helped them to
develop different research paradigms, such as epistemology, ontology and pragmatic paradigms
(Howell, 2012).
Epistemological research philosophy is considered as a way to which a researcher can
determine how the knowledge can be acquired in a research study, further developed and
transferred to processing. The epistemological philosophy can be largely categorised into three,
namely positivism, Interpretivism and realism (Calcaterra, 2011). In the positivism paradigm, the
researcher ensures that the findings of the research work are independent and it can help in
developing hypotheses. These hypotheses are developed so that the researcher can get to the
conclusion by testing the hypotheses with the help of statistical methods. Further, under the
interpretivism paradigm, it is found that the researcher integrates the findings of the research
with the views and perceptions of the researcher in order to address the aim of the study
(Calcaterra, 2011). On the other hand, realism paradigm helps in getting to the research findings
of the research work based on the reality, where the researcher tries to remove bias from the
study and get the results with the help of quantitative methods. Under ontological research
paradigm, the main focus is on the existing things or the reality. The ontological paradigm can be
classified into two parts that is constructivism and objectivism (Calcaterra, 2011). From the
examination done of the research paradigms, it can be said that for this research study,
interpretivism is best-suited paradigm as it will in analysing the personality, trust and culture
among the people of the Arab region.
Majorly there are three types of research paradigms which are used in research studies,
namely interpretivism, realism and positivism (Krauss, 2005). As per the interpretivism research
paradigm, the world is subjective and is formed with the norms of society. The interpretive
researchers believe that the knowledge can be gained from the world in which we live. The
knowledge can be obtained from the views of people based on their subjective experience in the
world. The knowledge is derived by the interpretive researcher after examining the knowledge

from people and studying in-depth about the related phenomena (Krauss, 2005). Therefore, it can
be said that interpretivism research paradigm develops interests of people into studies. It is
believed by the researchers that the views of people can be only be obtained by enhancing the
language, by being conscious and also by sharing meanings. As per the interpretive researcher,
the people provide knowledge based on their memories, experience and their expectation;
therefore, the results are derived based on their memories, expectation, and experience (Kuada,
2012). Interpretivism research paradigm was developed after finding out the demerits of using
positivism research study. The demerit which led to the use of interpretivism in this research
study is that by using the positivist research paradigm, a researcher cannot get a deep insight into
the research topic, as it is based on the basic description of the data found (Kuada, 2012).
3.5 Rationale for the Selection of Interpretivism Research Paradigm
In this research study, interpretivism research paradigm is used because as per the
interpretive researchers that subjective interpretations made on the basis of the experience and
memories of people are best suited for understanding the reality of the condition about the topic
(Pat, 2006). In interpretivism, the methodologies used, such as observation method or interview
method helps in deriving a subjective relationship between the subject of the research and the
researcher itself. Further, in realism, the researchers believe in reality even if they are not proven,
and they do not believe in science and observation (Krauss, 2005). In positivism paradigm,
hypotheses are developed based on the assumptions of the study, which help in getting to the
conclusion by testing the hypotheses. Therefore, the interpretivism paradigm is chosen in this
research study as it is best suitable.
3.6 Research Design
The research design is used in a research study to provide a proper structure to the
research work. In a research design, the researcher uses a strategy, by which all the components
of the study are well integrated so that the study becomes simpler and also can be represented in
a logical manner (Scruggs and Mastropieri, 2006). Research design also helps in addressing the
research problem as it makes the study simpler. It also consists of methods for data collection,

data assessing and analysing. There are three types of research design used in the research
methodology section, namely exploratory, descriptive and causal research design (Scruggs and
Mastropieri, 2006).
The exploratory research design is used by the researcher to gain an overall knowledge of
the research topic. These types of research design are useful for the researcher when the
researcher does not have much knowledge about the research topic, or the researcher wants some
additional information about the topic. The exploratory design is an informal approach to
conducting the research, as it collects additional information about the research topic and it also
focuses on testing the relationship between the two variables in the research study (Supino and
Borer, 2012). Testing of the variables can be done using the exploratory design, by
understanding the problem of the research study. The exploratory research design used in a
research study helps the researcher to increase familiarity with the research topic and also to
identify the problem associated with the research study. Therefore, exploratory research can help
in determining priority in research and defining the important terms. In this type of research
design, surveys, case study, qualitative methods can be used to collect the data regarding the
research topic (Supino and Borer, 2012).
3.7 Rationale for the Selection of Exploratory Research Design
In this research study, exploratory research design is used because this research design is
flexible and uses a systematic approach to getting to the conclusion. The flexible nature of the
research design also helps in understanding the research problem completely, by analysing all the
possible sources. In this research study, the objective is to find out the influence of value, culture
and trust in the Arab region to understand the behaviour, attitude and responsiveness on
information security awareness (Marczyk, DeMatteo and Festinger, 2010). Therefore,
exploratory research design can help the researcher to get a better overview of the research topic.
The research design also helped in getting a more precise solution to the research problem, and it
also helped in addressing all the research questions developed in the study (Marczyk, DeMatteo
and Festinger, 2010). Apart from exploratory research design, there are other two research
designs, namely descriptive and casual research design. Descriptive research design is not used
because it highly depends on the observational methods and casual research design is not used
because it uses experimental approach. The experimental approach is prone to alteration as per

the behaviour and responses (Marczyk, DeMatteo and Festinger, 2010). Therefore, exploratory
research design is best suited for this research study.
3.8 Use of Mixed Methods- Qualitative and Quantitative
The qualitative method of research is helpful in getting an insight of the research
problem, and it can also be used by the researcher to test the relationship between the two
variables of the research study so that further research can be conducted (Tracy, 2012). The
qualitative method explores new ideas about a research topic and provides in-depth knowledge
about the research topic. With the help of qualitative method, unstructured data can be collected
by using primary and secondary sources. The sources used for data collection are, interviews,
literary sources and internet sources of information (Tracy, 2012). The quantitative method of
research provides statistical data to the researcher to analyse the research problem and get to the
conclusion easily. The data collected using quantitative method is structured as compared to the
qualitative data. In this method, the data can be collected using survey questionnaire method,
case studies and reports of organisations (Wetcher-Hendricks, 2011). In this research study, a
mixed method is used which includes a qualitative method and quantitative method of research.
3.9 Research Approach
There are two types of research approach used in research methodology, namely
deductive approach and inductive approach. The inductive research approach is also known to be
a reasoning method which helps a researcher in inducing views in general from the existing or
the given information (Jonker and Pennink, 2010). The main advantage of using inductive
approach is that it helps in analysing the given information in the research study that is collected
by the researcher to conduct the work in a correct direction. The analysis of the collected
information helps the researcher to get to the conclusion by providing a generalised view about
the research topic (Jonker and Pennink, 2010). In this research study, the data is collected for
trust, culture and personality in the Arab region. The inductive research approach has helped in
getting the generalised view about the culture, trust and personality in Arab region from the
collected information so that an insight into attitude, behaviour and responsiveness on the
information security awareness is gained.

3.10 Rationale for the Selection of Inductive Research Approach
In this research study, inductive research approach is used because the inductive
approach is well aligned with the interpretivism paradigm. There are several stages in inductive
approach that helps the researcher in getting to the conclusion (Hair et al., 2012). The stages are,
observing the data collected for the research, observing the pattern of the change in data,
developing a theory on the basis of the findings of the data. Further, inductive approach is used
in this research study, because it provides flexibility as it enables to develop a new theory based
on the findings from the collected information (Hair et al., 2012). In this study, the inductive
approach has been useful for presenting the data obtained from the analysis of the data in getting
to the conclusion by testing the relationship between the two variables based on the research
topic (Hair et al., 2012).
3.11 Data Collection Methods
A process of citing and gathering the relevant information and moreover arranging them
into a structured format, as it eases the process of measuring the data according to the targeted
standards, which will allow a person to derive more relevant and significant information. This
method is known as data collection method. For the purpose of collecting adequate information,
it is required to adopt an appropriate method, which when is applied correctly ensures with a
suitable amount of information. This process includes techniques that are helpful in providing
proper answers to the questions and then facilitate the researcher with suitable outcomes for the
research question (Vartanian, 2010).
Data collection method is a very significant part of the entire research study as the
outcomes of the research depends on the data that has been gathered by implementing various
tools and techniques that are involved in this process. The objectives that are defined by the aims
and objectives of the research are accomplished for sure when the right technique or method of
data collection is selected. There are two variants of data collection methods. Based on their
nature, they are named as primary data collection methods and secondary data collection
methods (Supino and Borer, 2012).

3.11.1 Primary Data Collection Method
Primary data refers to that type of information or data which has been gathered from
various sources and is original as it is assembled for the first time. The data collected is further
evaluated on the basis of the existing needs and desire of the researcher, but before that, the data
is interpreted in a systematic manner to prepare a statistical table, which will allow the researcher
to extract the exact required information (Noor, 2008). There are multiple methods available to
collect data from various sources at a primary level that is for the first time. These methods are
described as follows:
• Interview method: This method includes the process of questioning various
individuals on the relevant topic of the research. The time is the most significant element for the
entire research study, and this method is a time taking process when a large number of samples
are needed to be collected. In addition, this process may make respondents uncomfortable, as
sometimes personal details are also required to furnish the details of the research study. On the
other hand, the positive aspects of this method are the quality of answers and adequate amount of
information (Noor, 2008).
• Observation: A special environment as per the needed details is collected and then the
participants are set in that place for the purpose of answering questions and then their answers
and behaviour are observed. This is an expensive method, but results justify the cost
appropriately (Noor, 2008).
• Surveys: Under this method, a questionnaire is prepared that consist of questions
which focus on the important aspects of the research study and on which the information is to be
derived from the individual participants. A large number of respondents are involved so that
ample amount of data can be collected (Noor, 2008).
3.11.2 Rationale for Choosing the Primary Data Collection Methods
For the purpose of this research, the primary data or the first-hand data is the most
appropriate choice to make. In relation to this research, the survey method is used, which
consists of a questionnaire of highly focussed questions that are appropriate to derive
information to address the research question. The survey is undertaken to collect relevant
information about the culture and the personality types of people that will be collected from the
general public of the Arab region. A group of the population was selected, and then the
questionnaires were prepared with the questions that were focused on deriving the information

about the nature of the people of the Arab region. The questions related to the personality traits
are designed and presented in the questionnaire, and then the same were distributed among the
respondents. Prior to this, the consent forms were distributed and were collected to know the will
of the people who want to be the part of the survey. The people who were selected for the survey
were selected from various classes and regions of Arab nations, as for the purpose of research it
was required to have people from different classes and areas. Therefore, the questionnaires were
mailed to the official mail ids of the respondents. The advantages of this process are that it is cost
efficient; covers large population, no prior requisites or arrangements are needed, no biases and
easy to manage (Sapsford and Jupp, 2006).
Thus, this process is a proper fit for this type of research and will assure suitable amount
of relevant data for the research study. The survey method is efficient in gathering data from a
large number of respondents as in this research it is required to be collected from various groups
of people belonging to different regions of Arab.
3.11.3 Primary Data: Questionnaire Survey Method
3.11.3.1 Rationale for Using Questionnaire Survey Method in this Research Study
Questionnaire survey method is chosen for this research study in order to analyse the
views of people living in Arab region regarding the personality, trust and culture within the
general people of the Arab region. It can be said that the questionnaire survey method can help in
collecting quantitative data regarding the research study (Cargan, 2007). This method is
advantageous as it is undertaken in proper steps and organised form so that data can be collected
on all the aspects that are related to the research study (Cargan, 2007). Further, it can be said that
questionnaire survey method helps in collecting data from a small part of the population. There
are various phases that are undertaken in the questionnaire survey method, such as planning the
questions, sampling, implementing the method, finally disseminating and documenting. It can
also be said that questionnaire survey method is considered as a highly efficient method for
primary data collection because it helps in collecting a large amount of data from a large
population but in a small time (Cargan, 2007). In this research study, questionnaire survey
method has been used to gather primary data from the general people of the Arab region, and it is
also ensured that the validity is being tested by the use of statistical methods (Cargan, 2007).
Therefore, it can be said that use of questionnaire survey method as primary data collection

method has improved the validity of the research study and has helped in gaining knowledge
about the research questions. The three research questions that can be addressed with the help of
primary data collection are based on the impacts of personality types on attitude, the impact of
trust on information sharing as found in Arab culture and mismatch between the western based
information security awareness training and local Arab culture.
3.11.5 Limitations of Survey Method as Primary Data Collection Method
It has been observed that questionnaire survey method is helpful in this research study, in
order to gain primary data regarding the research topic. At the same time, it can also be said that
there are certain limitations of suing questionnaire survey method for primary data collection
(Thomas, Nelson and Silverman, 2011). It can be said that while providing the responses in the
questionnaire, the respondents may not always be truthful, which can get the researcher in the
incorrect direction. Further, it is also possible that the respondents do not read the question
completely before answering it and thus, provide wrong information, which will further affect
the result of the research study. It is also observed that through interviews, we can communicate
with the respondents face-to-face and can analyse their emotions while gaining information, but
in surveys, we cannot gain their emotional view regarding the research study. It is also possible
that while answering the questions, respondents feel difficulty in analysing the questions as
survey questions are multiple choice questions. Therefore, it is possible that respondents skip
some of the questions due to the difficulty that they face while answering the questions (Thomas,
Nelson and Silverman, 2011).
3.12 Secondary Data Collection Methods
The data that is present or which already exists is considered as the secondary data and
collection of this type of data is considered as secondary data collection. The sources such as
journals, reports, online articles, magazines and academic books are considered as reliable
sources for the collection of secondary data. This method consists of various advantages that are
making this method completely suitable for the purpose of conducting the research study on a
large scale. The various associated benefits of secondary data collection method are related to
money, time and resources. This method is efficient in saving these said elements, and thus the
researcher is facilitated with current data at low costs and within a suitable time span. In this

process, the data is to be gathered from the sources where it already exists. Therefore, the only
job involved is related to selecting and gathering the data (Noor, 2008).
In addition to this, the data available is provided by the people who are scholars and
professionally well educated about the field they are imparting knowledge. Thus, this ensures
that the data collected will be authentic and related to the topic to the research study. Moreover,
the other requirements of this process are related to the transparency of the method and must
abide by the ethical code of conducting the research. It is a matter of concern while conducting
the research that the data must be properly collected in accordance with the data that has been
collected from the primary research method. In contrary to the relevant advantages of this
method the disadvantages are that the data collected could be insufficient or irrelevant at times.
Therefore, these points of disadvantage may discourage the researcher to use these methods
(Gomm, 2008).
3.12.1 Rationale for Selecting the Secondary Data Collection Methods
In relation to this research study, the methods of secondary data are employed for the
purpose of providing the data that has been already acquired by other researchers. Therefore, this
method is efficient in facilitating the researcher to have a second opinion of the other researchers
on the topic of the research study. The study of other scholars and academicians on the
personality of people belonging from Arab region is considered from the point of view of other
specialists. Moreover, the traits of trustworthiness and culture that is being followed by the
people of Arab regions are also taken under consideration to furnish the data for the present
research study. The researcher is provided with the detailed information that is effective in
explaining the concept of this research properly (Baruch and Holtom, 2008).
3.12.2 Secondary Data: Library Research Method
3.12.2.1 Rationale for Using Library Research Method in This Research
In order to collect secondary data for the purpose of data collection, library research
method will be applied. Library research method can be considered as a form through which
inquiry about a research topic can be done specifically, with the help of certain tools and
techniques involved in the method (Mann, 2015). In the process of library research method, the
researcher is enabled to identify and located the sources that are essential for this research work,
which will also help in getting to the conclusion of the study. Researcher in this method tries to

locate the sources which can address various components of the research study. In library
research method, keywords are essential as it helps in searching and locating the specific sources
in libraries, online and in databases. Further, it can also be said that with the help of keywords, a
systematic search can be done for the essential sources to address the components of the research
study (Mann, 2015). One of the advantages of using library research method in a research study
is that it is applicable in every research area and the information collected from the specific
sources of library research method are crucial for the research study. This method also helps in
increasing the credibility of the findings of the research study. Further, it can be said this method
can help compensating with the limitation of other methods that are used in the research study to
gather information regarding the research topic. The researcher should keep in mind while
collecting the data through secondary sources that the data must not be outdated (Watzlawik and
Born, 2007).
3.12.4 Limitation of Literature Review as Secondary Data Collection Method
The literature review method is useful in research studies to gain knowledge regarding
the research topic, but at the same time, it can be said that there are certain limitations of using
literature review in a research work. The data obtained with the help of literature review are
subjective, and it may sometimes confuse the researcher as to select which studies according to
the subject of the research study (Denzin and Lincoln, 2005). Therefore, it can also be said that
in some cases researcher may fail to get to the conclusions with the help of the studies selected.
Further, the researcher may also face difficulty in integrating the different components that have
been identified in the data collection through literary sources. In order to compensate the
limitations of data collection, this research study will include primary and secondary data
collection methods. It will also help in getting to the conclusion easily by comparing the findings
of both the data collection methods (Denzin and Lincoln, 2005).
3.13 Phases of Research under Data Collection of this Research Study
The phases of the research under data collection method, describes the phases that will
the research will undergo during data collection, such as data collection or design for survey.
3.13.1 Description of Phase 1
In the first phase of the research study, in-depth literature review is undertaken by the
researcher so as find out the answers to the research questions. The research questions are based

on the impact of trust on information sharing as found in Arab culture and mismatch between the
western based information security system and local Arab culture. Firstly, the literature review
will help the researcher in gaining an answer to the question; Trust is rooted culture within
Arab region. Trust can be dynamics based on the relationships but leads to
resistance behaviours towards western IS. At some point consequences could
result in when breaking cultural trust” Further, the literature review will focus on the
research question, “to what extent and in what manner is the role of trust as a component of
interpersonal relationships causing employees to share confidential information in Arab culture?”
The research will also include literature review regarding, “what changes can be made to western
based IS to reduce the mismatch? How can we influence the behaviour in Arab region specially
by utilising the existing cultural values?” For this purpose, the research will analyse different
theories related to the research question in this study and try to gain knowledge from secondary
sources so as to get to the conclusion easily. Since the data collected through secondary sources
will be subjective and it also has certain limitations which can be overcome with the help of
phase 2. Therefore, it can be said that there is a need for phase 2 in this research study so that
research questions can be addressed appropriately.
3.13.2 Data Collection in Phase 1: Library Research Method
In this research study, to collect data from secondary sources, library research method is
used. With the help of the library research method, the researcher will be enabled in developing
an effective theoretical framework regarding the research work. In library research method, the
researcher will make use of different secondary sources, such as academic sources, books, online
articles, journal articles and research paper presented in internationally. The researchers will also
data from different websites and databases regarding the research topic (Katsirikou and Skiadas,
2010). The data collection will help the researcher in exploring about the impacts of personality
types on attitude, the impact of trust on information sharing as found in Arab culture and
mismatch between the western based information security awareness training and local Arab
culture. Therefore, it can be said that this will generate an effective literature review regarding
the research topic. Further, it can be said that the entire process of data collection from secondary
sources with the help of library research method was done in order to explore the personality,
trust and culture within the general people of the Arab region. In this research study, the data

collection with the help of library research method has been applied with the help of keywords
such as personality, trust, attitudes of people and culture in the Arab region. In this research
study, the literature review done from various secondary sources also helped the researcher in
generating the questionnaire for survey method, as it covered all the themes regarding the
research study. Therefore, it can be said that with the help of literature review an effective
questionnaire for the survey can be generated (Katsirikou and Skiadas, 2010).
3.13.3 Limitation of Phase 1
There are certain limitations of each research and data collection method used in a
research study. Data collection in phase 1 was done by using library research method, which is
an efficient method to gather data from reliable sources on the research topic. Library research
method comes under secondary data collection method which has its limitations. Secondary data
collection is difficult as the researcher has to search for reliable sources of information regarding
the research topic (Mann, 2015). Therefore, the researcher must search for sources which are
authentic and provides a good source of information regarding the research topic.
Another limitation of secondary data collection is that the researcher cannot completely
rely on the secondary data as the data cannot be as per the needs of the study and the researcher.
Therefore, the researcher must find sources which are presented as per the requirement of the
study and as desired by the researcher. It is also found that in secondary data collection
sometimes, the researcher cannot get complete access to a book and due to which researcher may
get incomplete information regarding the research topic (Mann, 2015). Therefore, it can be said
that the researcher must ensure that the sources used by the researcher must provide complete
information regarding the research topic. Lastly, secondary data can be outdated and provide
outdated information regarding the research topic which can affect the results of the study. Thus,
it can be said that the sources used by the researcher should be latest and provide current
information regarding the research topic so that the findings of the study are reliable and can be
used by the future researchers (Mann, 2015).
In library research method, secondary data is collected by the researcher with the help of
online search. An online search can be performed by searching different sources using keywords
regarding the research study (Mann, 2015). It is found that library research method is
comparatively easier for the researcher as they can search for the data from anywhere and at any
time. It is also found that in library research method, researchers get confused as to use which

information source and which source will provide a good source of information. In an online
search, the researcher should also search reliable sources which will provide data as per the need
of the study and as desired by the researchers. It is further found that internet is a system, where
the researcher can find a variety of information regarding the research topic and the search can
be performed on the basis of the convenience and priority (Mann, 2015). It is found that internet
is a pool of information, but at the same time, it can be said that the information gathered from
the internet is not always true. There are various web pages which are designed by different
people, but those web pages do not provide authentic information regarding the research topic.
Therefore, it can be said that the information provided by internet is not always true and
authentic, so the researcher should try to search for authentic sources of information which can
be used in the completion of the research work (Mann, 2015).
3.13.4 Description of Phase 2
In the first phase, the research study provided a brief and generalised overview about the
research topic, which included the personality, trust and culture of the people of the Arab region.
With the brief overview on the research topic with the help of library research method, it is
essential that the survey is conducted with the people of Arab region so that the researcher can
get an insight into the personality, trust and culture within the Arab region. This phase will help
the researcher to conduct a survey with the general people of the Arab region and gather
information regarding the research topic. Further, the two phases will help the researcher in
getting a relationship between the personality, trust and culture. In order to conduct the survey,
the questionnaire is prepared by the researcher with the help of which the research aim can be
accomplished. According to the aim of the research, the researcher identifies how attitude and
responsiveness towards information security awareness Training are influenced by various
factors including personality characteristics and local cultural values and trust in Arab Region. In
order to accomplish the aim of the research study, the questionnaire was developed keeping the
objectives in mind. The objectives of the research cover the personality, trust and culture within
the Arab region. The objectives of the research are, firstly, investigate the factors that influence
human behaviours towards information security. Secondly, investigate the impact of trust in
Arab culture towards information sharing as well as Western information security mismatch.
Lastly, the research will identify the changes to western-based information security to reduce the
mismatch with local Arab culture.

3.13.5 Data Collection in Phase 2: Questionnaire Survey Method
Data collection will be done in phase two with the help of primary data collection
method. The method used for primary data collection in this research study is questionnaire
survey method. Questionnaire survey method is chosen for this research study in order to analyse
the views of people living in Arab region regarding the personality, trust and culture within the
general people of the Arab region. It can be said that the questionnaire survey method can help
the researcher in collecting quantitative data regarding the research study. Further, it can also be
said that the method is advantageous as it is undertaken in proper steps and organised form so
that data can be collected on all the aspects that are related to the research study (Cargan, 2007).
In this research study, questionnaire survey method has been used to gather primary data from
the general people of the Arab region, and it is also ensured that the validity is being tested by
the use of statistical methods.
3.13.5.1 Questionnaire Design for Survey
The questions are developed in this section of questionnaire design for the survey so that
the survey can be conducted by the people of the Arab region and gather data regarding
personality, trust and culture among the people of the Arab region. The questionnaire was
developed with the help of the findings from the literature review so that appropriate questions
can be developed as per the research study. It is found that the process involved in questionnaire
survey method is critical for the researcher the questions that should be developed in
questionnaire method must be understandable by the participants of the study. In this research
study, close-ended questions are developed for the questionnaire survey method so that the
specific data can be collected with the help of the participants of this research study. With the
help of the systematic survey, the researcher can gather the data to analyse the findings of the
research study and get to the conclusion easily. For the purpose of data collection through
questionnaire survey method, the close-ended questions and structures questions were developed
in simple English language. The language was chosen English so that every people of the Arab

region can understand the questions and provide their relevant answers. However, these
questions can be translated to the native Arabic speakers to ensure the understanding of the
questions.
3.14 Sample Size and Sample Technique
It is considered that determining the size of the sample in a research study is essential as
it is the integral part which helps the researcher in collecting the information regarding the study
and getting to the conclusion successfully. Sample size in a research study can be defined as the
total number of observations that will be considered in a data set (Lim and Ting, 2013). There
are two ways in which sampling technique is defined or categorised, namely, probability
sampling method and the second is non-probability sampling method. Probability sampling
method can be defined as a method of sampling in which the researcher is enabled to specify the
population that will be chosen for sampling. On the other hand, the non-probability sampling
method is another method of sampling in which the samples are collected from the chosen
population, but all the individuals among the total population are not given equal chances for
being selected for the sampling method. In research studies, the most commonly used sampling
types are, cluster sampling, convenience sampling, random sampling, stratified sampling and
systematic sampling. In this research study, random sampling and probability sampling methods
will be used in order to collect data from the samples for deriving knowledge out of the
information collected and getting to the conclusion easily (Lim and Ting, 2013).
Sample size will cover generally 300 or more if possible depending on the time selected. It will
target different people based on age, gender, education status, job title, and experience.
3.14.1 Rationale for Using Random Sampling Method
Selecting an appropriate sampling method is essential as it helps the researcher in
accomplishing the aim and objectives associated with the research study. Therefore, it can be
said that the best suitable sampling method for this research study is random sampling method
(Lim and Ting, 2013). The sample size is 300 general people of the Arab region, which belongs
to different classes and areas. The sample size is taken as 300 because it can help the researcher

in gathering adequate information regarding the personality, trust and culture in the Arab region.
If the sample size less than 300 is taken, then the researcher would not have been able to gather
adequate information regarding the research study. Therefore, to conduct an effective research
data analysis, 300 people of Arab region are adequate, but at the same time, it would consume
more time and efforts of the researcher to gather the information from the participants and
analyse it (Lim and Ting, 2013). Further, it is also possible that the costs to conduct the research
might increase. The random sampling method was applied to select 300 general people of Arab
region for the research study and the main purpose of applying random sampling method is to
remove bias from the study, in order to enhance the validity of the research work. With the help
of random sampling method used in this research work, the researcher will be able to gather the
information regarding the personality, trust and culture among the people of Arab region
effectively. It can also be said that with the help of the effective use of sampling technique, the
researcher will be able to evaluate and analyse the collected data in order to reach a conclusion
successfully (Lim and Ting, 2013).
3.15 Pilot Study
A pilot study is considered as a study which helps the researcher in conducting a
feasibility test. A pilot study is generally conducted in the form of a small experiment to test the
design and methods used in the research study. A pilot study is conducted before conducting the
completing a large study in order to improve the efficiency and quality of the research work
(Kuada, 2012). The main advantage of using a pilot study is that it can help the researcher in
determining the deficiencies of the research design applied in the research so that resources can
be saved. It is found that in order to conduct a research study efficiently and carefully, it is

required that the research conducts it by making plans. Therefore, it can be said that pilot study
can help a researcher in conducting research by developing a strategy (Kuada, 2012).
A pilot study is usually conducted by a researcher so that the researcher can conduct a
small comparison with the main study, in order to use fewer resources and analyse the main
experiment. It helps the researcher in correcting the errors while conducting the study so that the
study consumes less and effort of the researcher. It can also be said that a pilot study can help in
providing a large amount of data for conducting the analysis of the study so that the findings are
effective and the validity of the research can improve. It can be said that a systematic review can
be done by adding sources to the literature review section of the research study (Kuada, 2012). A
pilot study can help the researcher in providing vital information related to the research study, in
order to use a variety of procedures in the research study. Further, it can be said that pilot study
can help in assessing the feasibility of the research study and include a variety of information in
the research study. A pilot study can be conducted a variety of times in a research study;
therefore, it can be said that with the help of pilot study, a researcher can improve the results of
the study (Kuada, 2012).
In this research study, a pilot study was conducted in order to determine the reliability
and validity of the research study. Under the pilot study, the survey was conducted by the
researcher and to conduct the survey with the general people of the Arab region, emails and
messages were sent to them. The messages and emails were sent to ask for their participation in
the survey questionnaire regarding personality, trust and culture of the people of the Arab region.
For surveys, a questionnaire was mailed to the people to collect their views, and each survey was
collected through email. The survey and the collected data helped me in developing the report
regarding the personality, trust and culture within the general people of the Arab region. From

the findings of the data collection process under the pilot testing, it was observed that there were
certain issues that were resolved using the pilot testing. The issues regarding the data collection
process are:
 In the pilot testing survey was conducted among ten people within the Arab region. A
short was conducted so as to test the survey questions of the study and check whether the
questions are reliable or not for collecting information regarding the research topic.
 It was observed that initially all the questions were not answered by the respondents as
the questions were difficult to understand and the respondents were also facing the issue
of language.
 In order to conduct the survey on a large scale and get the desired results, the questions
were revised so that the respondents can easily understand all the questions and answer as
per the research topic.
 The correct answers from the respondents can help the researcher to accomplish the aim
of the research study.
 Further, it was ensured that the questions were not long and complicated for the
respondents. If the questions were difficult to understand, they were cut short for the
respondents to understand them easily.
3.16 Data Analysis Approach
Data analysis is an important part of a research study as it helps the researcher in
evaluating and analysing the data for the research work. Data analysis is carried in a process
where the data is initially evaluated and then the knowledge acquired is presented in an effective
manner. In a research study, it is essential to analyse the data collected so that research findings
can be obtained accurately and the integrity of the data can be maintained in the research work

(Jackson, 2008). It can be said that while analysing the data if statistical analysis is not done
properly by the researcher, then the scientific findings are said to be distorted in the research
study. Therefore, it can be said that data analysis is an important process of a research study
through which, the researcher can get to the conclusion easily. Data analysis is considered as a
systematic approach because it evaluates the gathered information and presents it in an effective
manner. This systematic approach also helps in addressing the research question by getting to the
conclusion. Data analysis can be done with the help of two methods, namely descriptive analysis
and graphical presentation method (Jackson, 2008).
The descriptive method of data analysis is used with theoretical data, where the
researcher wants to use the subjective type of data for knowledge generation. In descriptive
analysis method, the information is taken from the literature review of the research study. The
data is collected from the literature review section of the research work and then analysed by the
researcher using a systematic procedure of evaluation of data and presenting it in an effective
manner. This method of data analysis is efficient in gaining relevant knowledge out of the data
gathered for the research study and getting to the conclusion (Cavusgil and Riesenberger, 2009).
Further, graphical presentation method is another method which is used in research studies in
order to analyse the data collected for the study. Graphical presentation method of data analysis
is used in cases where quantitative data is collected for the research study in accordance with the
research question. In this method of data analysis, the quantitative data is collected with the help
of survey questionnaire method, and the data is plotted with the help of graphs. It can be said that
the graphical presentation method helps the researcher in presenting the views of the
respondents, collected in accordance with the research topic (Cavusgil and Riesenberger, 2009).

3.17 Rationale for Using Graphical Presentation Method
In this research study, graphical presentation method is used by the researcher in order to
evaluate the data collected and present it in an effective manner to answer the research question
easily. The data is collected in this research study with the help of survey questionnaire method
from 300 general people of the Arab region. The data collected through the survey will be
collected and plotted with the help of graphs so that conclusion can be derived easily. The data
presented through graphs is supported by relevant literature review so that the research can be
authentic (Blaikie, 2009). The reason for using graphical presentation method over the
descriptive method in this research study is that it is easier to interpret the data using graphs than
subjective data. The advantage of using graphical presentation method is that it provides a wider
perspective to the researcher so that analysis can be done easily and more information can be
derived from the data collected through a survey (Blaikie, 2009).
8. Ethical Considerations
Ethical considerations are essential for a researcher to follow in a research study as the
ethics consists of a set of principles which help the researchers in conducting the study ethically
and also consider the ethics while interacting with the people involved in the research study.
While interacting, there are various activities that may occur, such as survey, in-depth
interviews, focus groups and secondary data collection, which is done with the community
people (Oliver, 2010). In order to influence the report of the research, it is important for the
researcher to consider the ethical considerations while conducting the study. Therefore, it can be
said that it is the responsibility of the researcher to consider all the ethical considerations so that
no harm is caused to any individual while conducting the research. The researcher must also
ensure that the research is conducted by following a mechanism. It can be said that the researcher

must identify all the harms that can be caused during the process of conducting the research and
evaluate its impact on the research study (Oliver, 2010).
There are many reasons, due to which it can be said that the researcher must consider all
the ethical considerations while conducting the research. The first reason can be stated as, ethical
consideration, considered in a research indicate a sign of respect for all the researchers that will
conduct any research in future. By indicating the ethical considerations can help the researcher in
acquiring funds for the research which are important to conduct the research study. Ethical
considerations also help the researcher in getting the research accepted by the community and
help the researcher in avoiding any kind of criticism from the community people (Shamoo and
Resnik, 2009).
In this research study, ethical considerations are considered by the researcher in all the
areas of the research that are included in this study. The areas are the voluntary participation of
the respondents, taking consent before conducting the survey, maintaining confidentiality while
collecting the data, and proper communication with the respondents and communicating the
results (Shamoo and Resnik, 2009). In this research work, it was ensured while collecting the
primary data that the respondents have voluntarily participated in this research work and they are
not forced to answer the questions. It was also ensured that the participants were allowed to leave
the survey at any point they want and prior information was also conveyed before their
participation in the research study (Shamoo and Resnik, 2009). The respondents were provided
with the full identity of the researcher and the detailed information about the research aim, and
objectives were also provided. In this essence, written consent was also taken from the
participants of this research study in order to fulfil the ethics of the study (Shamoo and Resnik,
2009).

Another important ethical consideration that was considered by the researcher was that
the respondent's information was made confidential and also their answers were not shared with
other participants. It was ensured that the questions mentioned in the survey questionnaire did
not reveal the identity of the participant so that confidentiality can be maintained throughout the
research work (Shamoo and Resnik, 2009). The participation of the respondents was based on
equal participation, and no bias was done while conducting the survey. Further, when the results
were conveyed to the supervisor, it was ensured that the work did not contain any plagiarism in
research findings and representation of the results of the research work. Thus, it can be said that
all attempts were made by the researcher to fulfil all the ethical considerations while conducting
the research study (Shamoo and Resnik, 2009).
3.18 Authenticity, Bias, Validity and Reliability of the Research Study
Bias in Research Study: It is essential for a researcher to consider the bias issue in a
research study so that the researcher can ensure that the study is conducted authentically and
originality is also maintained throughout the study. As per the bias issue and factor that is
considered by the researcher in a study, it is not considered with the responses of the respondents
collected, that the information provided by the respondents have been manipulated in regard to
the original information or not (Bernard, 2012). In this research work, it is considered by the
researcher that the issue of bias can be prevented by providing equal opportunity to the
respondents who are participating in the research study and not letting the personal interventions
impact the selection process of respondents. If the respondents are selected by considering bias
as the process of selection then it can create conflicts between the groups and their opinion
regarding the research study (Bernard, 2012). Therefore, it is essential for a researcher to select
the respondent without personal intervention and for the benefit of the research work. In this

essence, this research study has adopted random sampling method for selecting the sample for
collecting the information regarding the research study. Random sampling method enables the
researcher to select the participants without bias and every individual is given equal right to
participate in the study and provide their views regarding the research topic (Bernard, 2012). In
this research study, the respondents have helped by providing information regarding the
personality, trust and culture within the Arab region.
Authenticity, Reliability and Validity: It is also found that authenticity, reliability and
validity is an important phase of a research study that must be considered by a researcher while
conducting the research study. If a researcher ensures that the study conducted is authentic,
reliable and valid, then it can be said that the results derived in the study are useful for the future
studies and the study can also be trusted by the users of the study. Reliability in a study means a
degree through which the researcher get same results even after several trails through
observation, questionnaire, test or any other procedure (Baumgarten, 2013). Therefore, it can be
said that in a research study, a researcher must get consistent results for the research questions
described in the study. There are three measures through which the reliability of a study can be
checked by the researcher, namely equivalence, stability and internal consistency. Further,
validity is also considered as a degree with the help of which the researcher is enabled to the
measures the research study in a correct way (Baumgarten, 2013). If a research study is
considered as reliable and valid, then it can be said that the findings of the research study are
accurate and the findings can be trusted by the users of the research study in the future. It can be
also be said that validity is an important component in a study as the researcher should ensure
that the information used in the research study must be facts that are universally accepted. A
research study can be considered as valid when the research study provides a good source of

information, knowledge and it should also the practical aspects regarding the research study. A
study should also include reliable sources of information, in order to improve the reliability of
the study (Baumgarten, 2013). Moreover, authenticity in a research study describes the factor of
trustworthiness regarding the research study. In a research study, authenticity can be maintained
by ensuring the identity and integrity for all the information sources that are utilised in
conducting the research study. It is found that the researchers can test the flaws in the research
with the help of pilot testing method. In pilot testing method, the questions generated for the
questionnaire are checked so that they are easily understandable by the respondents and also the
questions can be presented without any ambiguity (Cargan, 2007).
In this research study, the issue of bias is considered by the researcher so that all the
individuals can get equal opportunity of participating in the research study and the study
becomes free from any kind of discrimination. Further, authenticity, validity and reliability
criteria are also used in this research study in order to improve the effectiveness of the research
study. Therefore, it can be said that in this research study, all participants were provided with
equal opportunity and no discrimination was done while collecting data through survey
questionnaire. It is also considered in this study that reliable sources are chosen for collecting
information regarding personality, trust and culture within the people of Arab region and make
the study reliable. To meet the reliability criteria, it was ensured by the researcher that the survey
is conducted among the general people living in Arab region.
3.19 Research Limitations
While conducting a research study it is essential that the researcher accomplish the
research aims and objectives, in order to complete the study successfully. Therefore, it can be
said that conducting a study correctly is a difficult task and it requires an effective planning for

the research work. The planning helps the researcher in providing a proper structure to the
research study and selecting methods that can help the researcher in accomplishing the aims and
objectives of the study. It is found that the researchers conducting studies apply a wide range of
tools and techniques with appropriate methods in order to conduct the research work in the
correct direction and get to the conclusion easily (Creswell, 2003). It is also found that while
conducting a research study, researcher faces certain limitations which are handled by the
researcher during the completion of the research work. The limitations that are faced by the
researcher while conducting the research study are known as research limitations. The research
limitations can be said as a feature of research methodology, which influences the research
findings. Research limitations can also be considered as the constraints which occur due to the
chosen framework or method to conduct the study, which eventually impacts the research and
the validity of the research work. Therefore, it can be said that the research limitations are
essential to state in a dissertation so that the overall impact of the research limitations can be
evaluated for the validity of the research findings (Creswell, 2003).
In this research study, certain limitations have been identified which are needed to be
considered by the researcher in order to improve the validity of the study. The first limitation that
has been identified is related to the conduction of online survey among the general people of
Arab region. In this research study, the major focus of the researcher to collect the information
regarding the study was through the primary method of data collection, which is questionnaire
survey method (Creswell, 2003). In comparison to the questionnaire survey method of primary
data collection method, interview method is more reliable, as interview method provides more
accurate results. It is found that in interview method, the researcher can also analyse the correct
situation and emotions of the participants providing the responses to the question, while during

the survey fact-to-face interaction is not possible. In this research study, survey method is chosen
for collecting the information regarding the research work because of the time constraint
(Creswell, 2003). In this study, the sample size to collect the information is large; therefore, it is
difficult to interview all the people for collecting information regarding personality, trust and
culture within the Arab region. Second research limitation that may be faced by the researcher in
this research study, while conducting the research is that the respondents may not provide
accurate information regarding the questions. It is also found that respondents are not co-
operative sometimes while responding to the survey questions, which may give rise to issues for
the researcher while collecting the information regarding the research study. With respect to the
respondents in the study it is also found that the respondents may not agree to answer to the
questions which may delay the research work and also at the same time creates difficulty for the
researcher to get to the conclusion. Thus, it can be said that survey method can create an issue
due to the respondents in a research study and interview method is better than survey method to
gather information regarding a research study.
Thirdly, with respect to the survey questionnaire with open-ended questions, it is possible
that the respondents do not provide their responses as intended by the researcher. The unintended
responses from the respondents in a study can impact the research work as researcher may
misinterpret the information that is collected from various participants of the study. Further, it
can also lead to a negative influence on the research findings by the researcher (Creswell, 2003).
The fourth research limitation occurred during the research work when the researcher collected
the information with the help of questionnaire survey method. In this research study it was
observed that the respondents delayed in responding to the questionnaire; thus, the researcher
took more time in gathering all the information regarding the topic (Creswell, 2003). This

research limitation affected the timeline developed for the research study and the study was
delayed. The last research limitation that was faced by the researcher was regarding the collected
of information with the help of secondary data collection method. It was found that it was
difficult for the researcher to gather secondary data regarding personality, trust and culture
within the general people pf Arab region. It was also difficult for the researcher to find reliable
sources regarding the research study, as there are limited sources which present information
regarding the research topic. Therefore, more time was spent by the researcher to find reliable
sources for the research study (Creswell, 2003).
3.20 Summary
Research methodology is an important section of a research study which helps the
researcher in designing a method for the main research problem identified in the study. It also
helps the researcher in examining the characteristics of the research study by applying scientific
methods to get to the conclusion easily. It is essential that the research methodology is based on
the literature review section, as the literature review is conducted on the basis of the research
topic and main problem, covering the research entirely. Literature review section also enables the
researcher to include information regarding the research topic from various literary sources.
Further, it is found that there are certain characteristics of a research study which are fulfilled
using appropriate research methodology. The characteristics are, logical, systematic, reductive
and empirical. With the help of research methodology, a research can be carried out in a
systematic manner by collecting the relevant information as per the research topic. Research
methodology also carries out the study by deriving logical conclusion and to carry out the study,
empirical methods are suggested using the methodology section of the study. It is found that
another main advantage of using research methodology is that it helps the researcher in

explaining the concepts regarding the research study, which helps in further getting to the
conclusion. In this research study, research methodology has covered all the aims and objectives
of the research study, in order to introduce design and methods to gather relevant information
regarding the research study.
In the overview of personality, trust and culture within the people of Arab region it was
found that the cultural presence of the countries can be seen through modernisation and culture
followed by the people. In the Arab countries they have their main focus on the traditions that are
followed in Arabic style by the people over the years even though the people living in the Arab
region are found to be modernised. Further, it can also be said that the Arabic culture can be seen
through the lifestyles of people living in the Arab region. It is found that the inequalities exist
between the Arab nations regarding their cultural aspects. It is also seen that in workplaces,
authoritative policies are followed where it can be said that unequal distribution of power exist
between the higher and lower end of people working in the organisation. For the level of trust, it
can be said that the nations in Arab region has high level of trust among them and they are also
willing to share information with each other; therefore, it can be said that possibility of
misunderstandings is less and people have positive attitude.
One of the important sections of research methodology is research paradigm because it
helps the researcher to conduct the research successfully by providing a bigger and wider
perspective. It also includes a set of practices, beliefs, and views that guide the research study
towards successful completion. Further, it can be said that a research paradigm provides a
framework that helps in gathering academic ideas and scientific ideas, views of researcher and
beliefs of the researcher to conduct the research study and get some knowledge out of it. The
main advantage of involving research paradigm in a research methodology section is that it helps

the researcher in giving direction and foundation to a research work which can be considered as
the primary step of a research study. Another advantage of research paradigm can be stated as; it
provides a logical direction so that the study can be completed effectively by generating
knowledge out of the information collected. Research paradigm can also help the researcher to
develop the research design in accordance with the nature of the research study. There are three
types of research paradigms which are used in research studies, namely interpretivism, realism
and positivism. In positivism paradigm, it is found that the researcher ensures that the findings of
the research work are independent and it can help the researcher in developing hypotheses. These
hypotheses are developed so that the researcher can get to the conclusion by testing the
hypotheses with the help of statistical methods. In interpretivism paradigm, it is observed that the
world is subjective and is formed with the norms of society as per the researcher. The knowledge
can be obtained from the views of people based on their subjective experience in the world. The
knowledge is derived by the interpretive researcher after examining the knowledge from people
and studying in-depth about the related phenomena. Further, realism paradigm helps the
researcher to get to the research findings based on the reality, where the researcher tries to
remove bias from the study and get the results with the help of quantitative methods. In this
research study, the researcher has used interpretivism paradigm so that views of people can be
gathered. Interpretivism paradigm uses method such as observation method or interview method
helps the researcher to derive a subjective relationship between the subject of the research and
the researcher itself.
In the net section of research methodology, research design is included which is also an
important part of the methodology section. It can be said that research design is used in a
research study to provide a proper structure to the research work. In a research design, the

researcher uses a strategy, by which all the components of the study are well integrated so that
the study becomes simpler and also can be represented in a logical manner. It can also be said
that research design further helps the researcher in addressing the research problem as it makes
the study simpler. The main advantage of using research design in a study is that it consists of
methods for data collection, data assessing and analysing. It can help the researcher in
conducting the study appropriately and also incorrect direction. There are mainly three types of
research design available to conduct the research studies, namely exploratory, descriptive and
causal research design. In this research study, exploratory research design is used because it
helps the researcher to gain an overall knowledge of the research topic. It can also help the
researcher by gaining additional information about the research topic. The exploratory design is
considered as an informal approach to conduct the research, as it collects additional information
about the research topic and it also focuses on testing the relationship between the two variables
in the research study. The two variables are tested so that the researcher can understand the main
problem of the research study; therefore, it increases the familiarity of the research study. In this
type of research design, surveys, case study, qualitative methods can be used to collect the data
regarding the research topic.
In this research study mixed method is used as a research method. In mixed method,
qualitative method and quantitative method is used to gain information regarding the research
topic. The qualitative method of research is helpful in getting an insight of the research problem,
and it can also be used by the researcher to test the relationship between the two variables of the
research study so that further research can be conducted. Further, it has been found that with the
help of qualitative method of research a researcher is enabled to explore new ideas about a
research topic and provides in-depth knowledge about the research topic. It can also be said that

with the help of qualitative method, unstructured data can be collected by using primary and
secondary sources. The sources used for data collection are, interviews, literary sources and
internet sources of information. Second method of research is quantitative method which
provides statistical data to the researcher to analyse the research problem and get to the
conclusion easily. The data collected using quantitative method is structured as compared to the
qualitative data. Quantitative method uses survey questionnaire method, case studies and reports
of organisations to gather information.
In the net section inductive research approach is used in this research study. The
inductive research approach is also known to be a reasoning method which helps a researcher in
inducing views in general from the existing or the given information. One of the advantages of
using inductive approach is that it helps in analysing the given information in the research study
that is collected by the researcher to conduct the work in a correct direction. In this research
study, the inductive approach has helped the researcher in collecting data regarding trust, culture
and personality in the Arab region. The researcher has also gained the generalised view about the
culture, trust and personality in Arab region from the collected information so that the researcher
can get an insight into attitude, behaviour and responsiveness on the information security
awareness.
Data collection method is considered as the most important part of a research study, as it
is a process through which a researcher can gather relevant information and moreover arranging
the data into a structured format, as it eases the process of measuring the data according to the
targeted standards, which will allow a person to derive more relevant and significant
information. For the purpose of collecting adequate information, it is required to adopt an
appropriate method, which when is applied correctly ensures the researcher with a suitable

amount of information. With the help of data collection method the researcher has addressed
aims and objectives of the research study in significant manner. There are two types of data
collection methods that are used in a research study, namely primary method and secondary
method. Primary data refers to that type of information or data which has been gathered from
various sources and is original as it is assembled for the first time. The data collected is further
evaluated on the basis of the existing needs and desire of the researcher, but before that, the data
is interpreted in a systematic manner to prepare a statistical table, which will allow the researcher
to extract the exact required information. Primary data collection in this research study has been
done with the help of questionnaire survey method. Under this method, a questionnaire is
prepared that consist of questions which focus on the important aspects of the research study and
on which the information is to be derived from the individual participants. A large number of
respondents are involved so that ample amount of data can be collected. Primary data collection
method is used in this research study, because it helps the researcher in gathering first-hand data
which will collect relevant information about the culture and the personality types of people. The
questions related to the personality traits are designed and presented in the questionnaire, and
then the same were distributed among the respondents. Prior consent was also taken to know the
will of the people who want to be the part of the survey.
Secondary data collection was done with the help of library research method. The main
advantage of using library research method is that it enables the researcher to identify and
located the sources that are essential for this research work, which will also help the researcher in
getting to the conclusion of the study. The library research method involves keywords, that are
essential as it helps in searching and locating the specific sources in libraries, online and in
databases. It is found that, with the help of library research method, a researcher is enabled to

systematically search the required and essential sources to address the components of the
research study. The research methodology chapter also describes the phases of data collection, in
which primary data is collected and in second phase secondary sources are explored. The sample
size taken for conducting survey is 200 general people of Arab region and sampling technique
used to select the sample is random sampling method. Random sampling method is selected in
this research study as it helped the researcher in collecting data from the samples for deriving
knowledge out of the information collected and getting to the conclusion easily.

CHAPTER 4: DATA ANALYSIS
Descriptive statistics
N Range Minimu
m
Maximu
m
Mean Std.
Deviation
Varianc
e
age 25 36.00 24.00 60.00 36.6000 7.29155 53.167
education 25 2.00 1.00 3.00 1.2800 .54160 .293
Degree country 25 1.00 1.00 2.00 1.4800 .50990 .260
Occupation 25 14.00 1.00 15.00 8.1200 4.61266 21.277
Work
experience 25 19.00 2.00 21.00 10.6000 5.64948 31.917
Valid N
(listwise) 25
Outcome of descriptive statistics show that average number of selected respondents have
educational background in Science field. Further, tabular presentation shows that mean personnel
belong from home country. In addition to this, out of 25, average number of employees have
experience of approximately 11 years. Through statistical assessment it has identified that on
average number of employees are working as decision analyst.
Descriptive statistics pertaining to other variables
Frequencies
Statistics
ag
e
employe
esarehon
est
employees
aretrustwor
thy
employeesa
rekindandg
ood
employeesare
trusttoeachot
her
amtrust
fulpers
on
employeeswillrespondin
kindwhenotherstrustedt
hem
N
Va
lid 25 25 25 25 25 25 25
Mi
ssi
ng
0 0 0 0 0 0 0

Mea
n
36.
60
00
2.6000 2.5200 2.3200 2.7600 1.6400 1.9200
Med
ian
35.
00
00
2.0000 2.0000 2.0000 3.0000 2.0000 2.0000
Mod
e
33.
00 2.00 2.00 2.00 3.00 2.00 2.00
Std.
Devi
atio
n
7.2
91
55
1.04083 1.00499 .74833 .92556 .56862 .75939
Frequency Table
age
Frequency Percent Valid Percent Cumulative
Percent
Valid 24.00 1 4.0 4.0 4.0
29.00 2 8.0 8.0 12.0
30.00 1 4.0 4.0 16.0
31.00 1 4.0 4.0 20.0
32.00 2 8.0 8.0 28.0
33.00 3 12.0 12.0 40.0
34.00 2 8.0 8.0 48.0
35.00 2 8.0 8.0 56.0
37.00 1 4.0 4.0 60.0
38.00 1 4.0 4.0 64.0
39.00 1 4.0 4.0 68.0
40.00 1 4.0 4.0 72.0
41.00 2 8.0 8.0 80.0
42.00 2 8.0 8.0 88.0
44.00 1 4.0 4.0 92.0
47.00 1 4.0 4.0 96.0
60.00 1 4.0 4.0 100.0

Total 25 100.0 100.0
employeesarehonest
Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 3 12.0 12.0 12.0
2.00 10 40.0 40.0 52.0
3.00 7 28.0 28.0 80.0
4.00 4 16.0 16.0 96.0
5.00 1 4.0 4.0 100.0
Total 25 100.0 100.0
employeesaretrustworthy
Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 3 12.0 12.0 12.0
2.00 12 48.0 48.0 60.0
3.00 4 16.0 16.0 76.0
4.00 6 24.0 24.0 100.0
Total 25 100.0 100.0
employeesarekindandgood
Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 3 12.0 12.0 12.0
2.00 12 48.0 48.0 60.0
3.00 9 36.0 36.0 96.0
4.00 1 4.0 4.0 100.0
Total 25 100.0 100.0
employeesaretrusttoeachother

Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 3 12.0 12.0 12.0
2.00 5 20.0 20.0 32.0
3.00 12 48.0 48.0 80.0
4.00 5 20.0 20.0 100.0
Total 25 100.0 100.0
amtrustfulperson
Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 10 40.0 40.0 40.0
2.00 14 56.0 56.0 96.0
3.00 1 4.0 4.0 100.0
Total 25 100.0 100.0
employeeswillrespondinkindwhenotherstrustedthem
Frequency Percent Valid Percent Cumulative
Percent
Valid
1.00 7 28.0 28.0 28.0
2.00 14 56.0 56.0 84.0
3.00 3 12.0 12.0 96.0
4.00 1 4.0 4.0 100.0
Total 25 100.0 100.0
Bar Chart

Independent sample t test
Hypothesis
Null hypothesis (H0): There is no significant difference in the mean values of employee honesty
with BSc's and individuals with MBAs.
Alternative hypothesis (H1): There is a significant difference in the mean values of employee
honesty with BSc's and individuals with MBAs.

Group Statistics
education N Mean Std. Deviation Std. Error Mean
employeesarehonest BSC 19 2.6842 1.15723 .26549
MBA 5 2.4000 .54772 .24495
Independent Samples Test
Levene's
Test for
Equality of
Variances
t-test for Equality of Means
F Sig. t df Sig.
(2-
tailed)
Mean
Difference
Std. Error
Difference
95% Confidence
Interval of the
Difference
Lower Upper
employeesarehonest
Equal
variances
assumed
3.140 .090 .527 22 .603 .28421 .53906 -.8337
3 1.40215
Equal
variances
not
assumed
.787 14.478 .444 .28421 .36122 -.4881
5 1.05657
P>0.05: null hypothesis accepted
Interpretation: By doing statistical analysis, it has found that p>0.05, such as .603
and .444 respectively. This aspect clearly presents that null hypothesis is true and other one false.
Referring overall outcome it can be depicted that employees honesty is not differing in the
context of individuals with MBA and BSC.

5 References
1. ABRAHAM, S. & CHENGALUR-SMITH, I. 2010. An overview of social engineering
malware: Trends, tactics, and implications. Technology in Society, 32, 183-196.
2. ALBRECHTSEN, E. & HOVDEN, J. 2010. Improving information security awareness
and behaviour through dialogue, participation and collective reflection. An intervention
study. Computers & Security, 29, 432-445.
3. ALNATHEER, M. & NELSON, K. 2009. Proposed framework for understanding
information security culture and practices in the Saudi context.
4. AYTES, K. & CONNOLLY, T. 2005. Computer security and risky computing practices:
A rational choice perspective. Advanced Topics in End User Computing, Volume 4, 4,
257.
5. B. KIM, E. 2014. Recommendations for information security awareness training for
college students. Information Management & Computer Security, 22, 115-126.
6. BAKER, W., GOUDIE, M., HUTTON, A., HYLENDER, C. D.,
NIEMANTSVERDRIET, J., NOVAK, C., OSTERTAG, D., PORTER, C., ROSEN, M.
& SARTIN, B. 2010. 2010 Data Breach Investigations Report. United States Secret
Service.
7. BUSINESS, V. 2011. Verizon Data Breach Investigations Report.
8. COLWILL, C. 2009. Human factors in information security: The insider threat–Who can
you trust these days? Information security technical report, 14, 186-196.
9. CTICES, S. 2001. Designing a Security Awareness Program: Part.
10. D., S., I, LIGINLAL & L, K. 2009. Coputer and security. How significant is human error
as cause of privacy breaches? An empirical study and framework for error management,
Vol.25 No.4, pp 289-296.
11. DIMOPOULOS, V., FURNELL, S., JENNEX, M. & KRITHARAS, I. Approaches to IT
Security in Small and Medium Enterprises. AISM, 2004. Citeseer, 73-82.

12. DLAMINI, M., ELOFF, J. H. & ELOFF, M. M. 2009. Information security: The moving
target. Computers & Security, 28, 189-198.
13. DODGE JR, R. C., CARVER, C. & FERGUSON, A. J. 2007. Phishing for user security
awareness. Computers & Security, 26, 73-80.
14. EDWARDS, A. 1953. Journal of Applied Psychology. The Relationship Between the
Judged Desirability of a Trait and the Probability That the Trait Will Be Endorsed, Vol.
37, No 2.
15. EDWARDS, A. L. 1953. The relationship between the judged desirability of a trait and
the probability that the trait will be endorsed. Journal of Applied Psychology, 37, 90.
16. EMINAĞAOĞLU, M., UÇAR, E. & EREN, Ş. 2009. The positive outcomes of
information security awareness training in companies – A case study. Information
Security Technical Report, 14, 223-229.
17. F.J, F. 2002. Survey research Methods. 3rd ed,sage, Thousand Oaks,CA.
18. FENZ, S., HEURIX, J., NEUBAUER, T. & PECHSTEIN, F. 2014. Current challenges in
information security risk management. Information Management & Computer Security,
22, 410-430.
19. FURNELL, S., CLARKE, N., PATTINSON, M. R. & ANDERSON, G. 2007. How well
are information risks being communicated to your computer end-users? Information
Management & Computer Security, 15, 362-371.
20. FURNELL, S. M., CLARKE, N., BAKHSHI, T., PAPADAKI, M. & FURNELL, S.
2009. Social engineering: assessing vulnerabilities in practice. Information management
& computer security, 17, 53-63.
21. GARDNER, H. 2004. Changing minds: The art and science of changing our own and
other people's minds, Harvard Business Press.
22. GARDNER, H. 2004. Changing minds: The art and science of changing our own and
other people's minds, Harvard Business Press.
23. GOLDSTEIN, I. L. 1993. Training in organizations: Needs assessment, development, and
evaluation, Thomson Brooks/Cole Publishing Co.
24. GOLDSTEIN, I. L. & FORD, J. K. 2002. Training in organizations: Needs assessment,
development, and evaluation.

25. HADNAGY, C. J., AHARONI, M. & O’GORMAN, J. 2010. Social Engineering Capture
the Flag Results Defcon 18. Retrieved October, 30, 2010.
26. HAYDEN, L. 2009. Human information security behaviors: Differences across
geographies and cultures in a global user survey. Proceedings of the American Society
for Information Science and Technology, 46, 1-16.
27. INGERMAN, B. L. & YANG, C. 2011. Top-Ten IT Issues, 2011. Educause Review, 46,
24.
28. KARJALAINEN, M. 2011. Improving employees. Information systems (IS) security
behaviour:toward a meta-theory of is security training and a new framework for
understanding employees' is security behaviour.
29. KARJALAINEN, M. & SIPONEN, M. 2011. Toward a new meta-theory for designing
information systems (IS) security training approaches. Journal of the Association for
Information Systems, 12, 518-555.
30. KING, S. B., KING, M. & ROTHWELL, W. J. 2001. The Complete Guide to Training
Delivery: A Competency-Based Approach, ERIC.
31. KING, S. B., KING, M. & ROTHWELL, W. J. 2001. The Complete Guide to Training
Delivery: A Competency-Based Approach, ERIC.
32. KRAEMER, S., CARAYON, P. & CLEM, J. 2009. Human and organizational factors in
computer and information security: Pathways to vulnerabilities. Computers & Security,
28, 509-520.
33. KRUGER, H. A. & KEARNEY, W. D. 2006. A prototype for assessing information
security awareness. computers & security, 25, 289-296.
34. LIGINLAL, D., SIM, I. & KHANSA, L. 2009. How significant is human error as a cause
of privacy breaches? An empirical study and a framework for error management.
Computers & Security, 28, 215-228.
35. LUNT, B. M., EKSTROM, J. J., GORKA, S., HISLOP, G., KAMALI, R., LAWSON, E.,
LEBLANC, R., MILLER, J. & REICHGELT, H. 2008. Curriculum guidelines for
undergraduate degree programs in information technology. Retrieved March, 2, 2009.
36. MACONACHY, W. V., SCHOU, C. D., RAGSDALE, D. & WELCH, D. A model for
information assurance: An integrated approach. Proceedings of the 2001 IEEE
Workshop on Information Assurance and Security, 2001. New York, USA.

37. NIST, S. 1998. 800-16, National Institute of Standards and Technology (NIST).“.
Information Technology Training Requirements: A Role-and Performance-Based Model
(NIST Special Publication 800-16)”, Washington, DC: US Department of Commerce.
38. OKENYI, P. O. & OWENS, T. J. 2007. On the anatomy of human hacking. Information
Systems Security, 16, 302-314.
39. PAHNILA, S., SIPONEN, M. & MAHMOOD, A. Employees' behavior towards IS
security policy compliance. System Sciences, 2007. HICSS 2007. 40th Annual Hawaii
International Conference on, 2007. IEEE, 156b-156b.
40. PARSONS, K., MCCOMAC, A., PATTINSON, M., BUTAVICIUS & JERRAM, C.
2013. A study of information security awareness. Information Management & Computer
Security, 334-345.
41. PARSONS, K., MCCORMAC, A. & BUTAVICIUS, M. 2011. Don't Judge a (Face)
Book by its Cover: A critical review of the implications of social networking sites. DTIC
Document.
42. PARSONS, K., MCCORMAC, A., BUTAVICIUS, M. & FERGUSON, L. 2010. Human
factors and information security: individual, culture and security environment. DTIC
Document.
43. PARSONS, K., MCCORMAC, A., PATTINSON, M., BUTAVICIUS, M. & JERRAM,
C. 2014. A study of information security awareness in Australian government
organisations. Information Management & Computer Security, 22, 334-345.
44. PATTINSON, M. R. & ANDERSON, G. 2007. How well are information risks being
communicated to your computer end‐users? Information Management & Computer
Security, 15, 362-371.
45. PRO. CLARKE, N. & PRO. FURNELL, S. 2014. International Symposium on Human
Aspects of Information Security & Assurance HAISA.
46. PUHAKAINEN, P. & SIPONEN, M. 2010. Improving employees' compliance through
information systems security training: an action research study. Mis Quarterly, 34, 757-
778.
47. PUHAKAINEN, P. & SIPONEN, M. 2010. Improving employees' compliance through
information systems security training: an action research study. Mis Quarterly, 34, 757-
778.

48. R.PATTINSON, M. & ANDERSON, G. 2007. Information Management& computer
security. How well are information risks being communicated to your computer end-
users?, Vol. 15 No.5 pp.362-371.
49. RANTOS, K., FYSARAKIS, K. & MANIFAVAS, C. 2012. How effective is your
security awareness program? An evaluation methodology. Information Security Journal:
A Global Perspective, 21, 328-345.
50. REZGUI, Y. & MARKS, A. 2008. Information security awareness in higher education:
An exploratory study. Computers & Security, 27, 241-253.
51. RICHARDSON, R. 2011. 15th annual 2010/2011 computer crime and security survey.
Computer Security Institute, 1-44.
52. SHAW, R. S., CHEN, C. C., HARRIS, A. L. & HUANG, H.-J. 2009. The impact of
information richness on information security awareness training effectiveness. Computers
& Education, 52, 92-100.
53. SIPONEN, M., PAHNILA, S. & MAHMOOD, A. 2007. Employees’ adherence to
information security policies: an empirical study. new approaches for security, privacy
and trust in complex environments. Springer.
54. SIPONEN, M. T. 2000. A conceptual foundation for organizational information security
awareness. Information Management & Computer Security, 8, 31-41.
55. SLEEZER, C. M. 1993. Training needs assessment at work: A dynamic process. Human
Resource Development Quarterly, 4, 247-264.
56. SPECTOR, P. E. 1994. Using self‐report questionnaires in OB research: a comment on
the use of a controversial method. Journal of Organizational Behavior, 15, 385-392.
57. STANTON, J., R.STAM, K., MASTRANGELO, P. & JOLTON, J. 2005. Computer
Security. Analysis of end user security behaviors, 24, 124-133.
58. STANTON, J. M., STAM, K. R., MASTRANGELO, P. & JOLTON, J. 2005. Analysis
of end user security behaviors. Computers & Security, 24, 124-133.
59. STRAUB, D. W. & WELKE, R. J. 1998. Coping with systems risk: security planning
models for management decision making. Mis Quarterly, 441-469.
60. STRAUB JR, D. W. 1990. Effective IS security: An empirical study. Information
Systems Research, 1, 255-276.

61. VINCENT, A. & ROSS, D. 2001. Personalize training: determine learning styles,
personality types and multiple intelligences online. The Learning Organization, 8, 36-43.
62. VON SOLMS, B. & VON SOLMS, R. 2004. The 10 deadly sins of information security
management. Computers & Security, 23, 371-376.
63. WILSON, M., DE ZAFRA, D. E., PITCHER, S. I., TRESSLER, J. D. & IPPOLITO, J.
B. 1998. Information technology security training requirements: A role-and performance-
based model. DTIC Document.
64. WILSON, M., DE ZAFRA, D. E., PITCHER, S. I., TRESSLER, J. D. & IPPOLITO, J.
B. 1998. Information technology security training requirements: A role-and performance-
based model. DTIC Document.
65. WILSON, M. & HASH, J. 2003. Building an information technology security awareness
and training program. NIST Special publication, 800, 50.
66. WILSON, M. & HASH, J. 2003. Building an information technology security awareness
and training program. NIST Special publication, 800, 50.
67. WORKMAN, M. 2007. Gaining access with social engineering: An empirical study of
the threat. Information Systems Security, 16, 315-331.
68. WORKMAN, M., BOMMER, W. H. & STRAUB, D. 2008. Security lapses and the
omission of information security measures: A threat control model and empirical test.
Computers in Human Behavior, 24, 2799-2816.
69. ZEMKE, R. & HOWARD, A. 1994. Training needs assessment: The broadening focus of
a simple construct. Diagnosis for organizational change: Methods and models, 139-151.
70. ZEMKE, R. & HOWARD, A. 1994. Training needs assessment: The broadening focus of
a simple construct. Diagnosis for organizational change: Methods and models, 139-151.
71. Abdel-Aziz, A. (2010). A Bit of Psychology to Improve your Security Awareness
Program.
72. Acquisti, A., & Gross, R. 2006. Imagined communities: Awareness, information sharing,
and privacy on the Facebook. Proceedings of the 6th Workshop on Privacy Enhancing
Technologies (PET), June 28, 2006. Cambridge England.
73. Andress, J. (2014). The basics of information security: understanding the fundamentals of
InfoSec in theory and practice. Syngress.

74. Anti-Phishing Working Group. 2014. Phishing Activity Trends Report, 1st Quarter 2014.
[online]. Available at: <http://docs.apwg.org/reports/apwg_trends_report_q1_2014.pdf>
[Accessed April 1, 2015].
75. Arachchilage, N. A. G., & Love, S. 2014. Security awareness of computer users: A
phishing threat avoidance perspective. Computers in Human Behavior, 38, 304-312.
76. Binden, W., Jormae, M., Zain, Z., & Ibrahim, J. 2014. Employing information security
awareness to minimize over-exposure of average Internet user on social networks.
International Journal of Scientific and Research Publications, 4(1), 1-6.
77. Butterworth-Heinemann (Firm). 2009. Securing intellectual property: Protecting trade
secrets and other information assets. Burlington, MA: Butterworth-Heinemann/Elsevier.
78. Department for Business, Innovation and Skills. 2014. 2013-Information Security
Breaches Survey: Technical Report. [online]. Available at:
<https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/191671/
bis-13-p184es-2013-information-security-breaches-survey-executive-summary.pdf>
[Accessed April 1, 2015].
79. Fenz, S., Heurix, J., Neubauer, T., & Pechstein, F. 2014. Current challenges in
information security risk management. Information Management & Computer Security
22(5), 410-430. DOI10.1108/IMCS-07-2013-0053
80. Gupta, N. 2014. Analysis of Issues in phishing attack and development of prevention
mechanism. Journal of Global Research in Computer Science, 5(6), 22-125.
81. IBM. 2015. IBM - Data breach statistics - United States. [online]. Available at:
<http://www-935.ibm.com/services/us/en/it-services/security-services/data-breach/>
[Accessed April 1, 2015].
82. Parsons, K, McCormac A., & Butavicius, M. 2014. Don't Judge a (Face) Book by its
Cover: A Critical Review of the Implications of Social Networking Sites. Australia:
Command, Control, Communications and Intelligence Division.
83. Shan, H. (2008). Protection of trade secrets in China. Alphen aan den Rijn, The
Netherlands: Kluwer Law International.
84. Xiao, Z., & Xiao, Y. 2013. Security and privacy in cloud computing. Communications
Surveys & Tutorials, IEEE, 15(2), 843-859.

85. Heinströ m, Jannica. "Five personality dimensions and their influence on information
behaviour." Information research 9.1 (2003): 9-1.
86. Abah, A. L. 2011. Mediating Identity and Culture. Hershey: IGI Global.
87. ADC. 2009. Facts about Arabs and the aArb World. [Online]. Available at:
http://www.adc.org/2009/11/facts-about-arabs-and-the-arab-world/ [Accessed on: 07
March 2017].
88. Baruch, Y. and Holtom, B.C. 2008. Survey response rate levels and trends in
organizational research. Human Relations, 61(8), pp. 1139-1160.
89. Baumgarten, M. 2013. Paradigm Wars - Validity and Reliability in Qualitative Research.
Germany: GRIN Verlag.
90. Bernard, H.R. 2012. Social Research Methods: Qualitative and Quantitative Approaches.
SAGE Publications.
91. Blaikie, N. 2009. Designing Social Research. Polity.
92. Calcaterra, R.M. 2011. New Perspectives on Pragmatism and Analytic Philosophy. New
York: Rodopi.
93. Cargan, L. 2007. Doing Social Research. Plymouth: Rowman & Littlefield.
94. Cargan, L. 2007. Doing Social Research. Plymouth: Rowman & Littlefield.
95. Cavusgil, S.T. and Riesenberger, J. 2009. Conducting Market Research for International
Business. Business Expert Press.
96. Chrysostome, E.V. 2014. Building Businesses in Emerging and Developing Countries:
Challenges and Opportunities. London: Routledge.
97. Creswell, J.W. 2003. Research Design: Qualitative, Quantitative, and Mixed Methods
Approaches. SAGE Publications.

98. Denzin, N.K. and Lincoln, Y.S. 2005. The SAGE Handbook of Qualitative Research.
London: SAGE.
99. El-Shibiny, M. 2005. The Threat of Globalization to Arab Islamic Culture: The
Dynamics of World Peace. Dorrance Publishing.
100. Gomm, R. 2008. Social Research Methodology: A Critical Introduction. New
York: Palgrave Macmillan.
101. Hair, J.F., Celsi, M.W., Money, A.H., Samouel, P. and Page, M.J. 2012.
Essentials of Business Research Methods. M.E. Sharpe.
102. Hessle, S. 2016. Global Social Transformation and Social Action: The Role of
Social Workers: Social Work-Social Development, Volume 3. London: Routledge.
103. Höhmann, H.-H., & Welter, F. (2005).Trust and entrepreneurship: a West-East
perspective. Cheltenham: Edward Elgar.
104. Howell, K.E. 2012. An Introduction to the Philosophy of Methodology. Los
Angeles: SAGE.
105. Jackson, S. 2008. Research Methods and Statistics: A Critical Thinking
Approach. Boston: Cengage Learning.
106. Jonker, J. and Pennink, B. 2010. The Essence of Research Methodology: A
Concise Guide for Master and PhD Students in Management Science. Berlin: Springer.
107. Katsirikou, A. and Skiadas, C.H. 2010. Qualitative and Quantitative Methods in
Libraries: Theory and Applications. World Scientific.
108. Krauss, S.E. 2005. Research Paradigms and Meaning Making: A Premier. The
Quantitative Report 10(4), pp. 758-770.

109. Kuada, J. 2012. Research Methodology: A Project Guide for University Students.
Frederiksberg: Samfundslitteratur.
110. Levers, M. D. 2013. Philosophical Paradigms, Grounded Theory and Perspectives
on Emergence. [Online] Available at:
http://sgo.sagepub.com/content/3/4/2158244013517243 [Accessed on: 25 October 2016].
111. Lim, W. M. And Ting. D.H. 2013. Research Methodology: A Toolkit of Sampling
and Data Analysis Techniques for Quantitative Research. GRIN Verlag.
112. Lunt, N., Horsfall, D. and Hanefeld, J. 2015. Handbook on Medical Tourism and
Patient Mobility. Cheltenham: Edward Elgar Publishing.
113. Mann, T. 2015. The Oxford Guide to Library Research. Oxford University Press.
114. Mann, T. 2015. The Oxford Guide to Library Research. Oxford: Oxford
University Press.
115. Marczyk, G.R., DeMatteo, D. and Festinger, D. 2010. Essentials of Research
Design and Methodology. New Jersey: John Wiley & Sons.
116. Noor, K.B.M. 2008. Case study: A strategic research methodology. American
journal of applied sciences, 5(11), pp.1602-1604.
117. Oliver, P. 2010. The Student's Guide to Research Ethics. Berkshire: McGraw-Hill
Education (UK).
118. Pat, C. 2006. The Research Student's Guide to Success. McGraw-Hill
International.
119. Sapsford, R. and Jupp, V. 2006. Data Collection and Analysis. London: SAGE.
120. Scruggs, T.E. and Mastropieri, M.A. 2006. Applications of Research
Methodology. Emerald Group Publishing.

121. Sekaran, U. and Bougie, R. 2010. Research Methods for Business: A Skill
Building Approach. New Jersey: John Wiley & Sons.
122. Shamoo, A.E. and Resnik, D.B. 2009. Responsible Conduct of Research. Oxford:
Oxford University Press.
123. Supino, P.G. and Borer, J.S. 2012. Principles of Research Methodology: A Guide
for Clinical Investigators. Berlin: Springer.
124. Thomas, J.R., Nelson, J.K. and Silverman, S.J. 2011. Research Methods in
Physical Activity. Windsor: Human Kinetics.
125. Tracy, S.J. 2012. Qualitative Research Methods: Collecting Evidence, Crafting
Analysis, Communicating Impact. New Jersey: John Wiley & Sons.
126. UNESCO. 2016. Regional overview : Arab States. [Online]. Available at:
http://en.unesco.org/unesco_science_report/arab-states [Accessed on: 23 January 2017].
127. Vartanian, T.P. 2010. Secondary Data Analysis. Oxford University Press.
128. Watzlawik, M. and Born, A. 2007. Capturing Identity: Quantitative and
Qualitative Methods. University Press of America.
129. Wetcher-Hendricks, D. 2011. Analyzing Quantitative Data: An Introduction for
Social Researchers. New Jersey: John Wiley & Sons.
130. Hill, C., Loch, K., Straub, D.W. and El-Sheshai, K. 1998. A Qualitative
Assessment of Arab Culture and Information Technology Transfer. Journal of Global
Information Management 6(3), pp. 29-38.