Analyzing Information Security in the Arab World: Culture & Trust

This project delves into the critical aspects of information security within the Arab world, examining the interplay of culture, trust, and human behavior. It begins with an overview of the Arab region, highlighting the importance of information security and the challenges posed by cultural nuances. The project explores the concept of Wasta and its influence, alongside an in-depth literature review that investigates cultural factors, trust dynamics, and the mismatch between Western IT technology and local practices. The research methodology employs a mixed-methods approach, including questionnaire surveys and library research, to analyze the attitudes and behaviors affecting information security. The study explores personality factors, such as neuroticism and extraversion, and their effects on attitudes toward information security. It also examines the implications of trust and information sharing within the Arab context. The project outlines the research questions, methods, and design, including an exploratory design, inductive approach, and detailed data collection phases. The project also presents data analysis methods and addresses research limitations, providing a comprehensive understanding of information security in the Arab world. The project includes detailed sections on methodology, data analysis, and findings, with references to relevant research.

Contents
1 Introduction...................................................................................................................................5
1.1Overview.................................................................................................................................5
1.1.1Overview of Arab Region.................................................................................................5
2 Information security and human behaviours ................................................................................7
3Non-academic contribution ...........................................................................................................9
Overview of Wasta and Islam..........................................................................................................9
3.1Trust......................................................................................................................................11
3.2 The importance of family.....................................................................................................12
4 Literature review ........................................................................................................................14
Overview and structure..............................................................................................................14
4.1 Objectivise and orientation ..................................................................................................15
4.1.1Culture............................................................................................................................15
4.1.2 Trust dynamics .............................................................................................................16
4.1.4 Mismatch with western IT Technology ...................................................................17
4.1.5 Personality types............................................................................................................18
5 Introduction ................................................................................................................................18
Overview.......................................................................................................................................18
5.1 Overview of Personality, Trust and Culture within Arab Region........................................20
5.2 Cultural similarity................................................................................................................22
5.3 Research in Culture by Hofstede..........................................................................................25
5.4 Trust.....................................................................................................................................27

5.4.1 Trust and Relationships.................................................................................................27
5.4.2 Arab cultural antecedents of trust..................................................................................29
5.4.3 The Universal Approach towards Trust.........................................................................31
5.4.4 Openness to Communication.........................................................................................32
5.4.5 Relationship on Sharing Information............................................................................32
5.4.6 Variables of Shared Culture, Environment and Values in Communication..................33
5.4.7 Style of Management in the Arab world.......................................................................35
5.4.8 Trust in Diversity...........................................................................................................35
5 .5 Western Information Technology.......................................................................................37
5.6 Attitudes affecting the information security behaviours ....................................................39
5.7 Personality Factors effects on attitude towards information security..................................50
5.7.1 Neuroticism ..................................................................................................................51
5.7.2 Extraversion –Introversion............................................................................................52
5.7.3 Openness .......................................................................................................................53
5.7.4 Agreeableness................................................................................................................53
5.7.5 Conscientiousness .......................................................................................................53
5.8 Personality traits, Information sharing, and Trust................................................................54
3 Methodology chapter..................................................................................................................56
..................................................................................................................................................57
3.1 Research Questions..............................................................................................................57
3.2 Methods and Approaches.....................................................................................................59
3.3 Proposed methods................................................................................................................61
3.3 Rational selection for methodology.....................................................................................80
3.4 Research Paradigm...............................................................................................................82
3.5 Rationale for the Selection of Interpretivism Research Paradigm.......................................85

3.6 Research Design...................................................................................................................85
3.7 Rationale for the Selection of Exploratory Research Design...............................................86
3.8 Use of Mixed Methods- Qualitative and Quantitative.........................................................87
3.9 Research Approach..................................................................................................................87
3.10 Rationale for the Selection of Inductive Research Approach............................................88
3.11 Data Collection Methods.......................................................................................................88
3.11.1 Primary Data Collection Method.................................................................................89
3.11.2 Rationale for Choosing the Primary Data Collection Methods...................................90
3.11.3 Primary Data: Questionnaire Survey Method.............................................................91
3.11.3.1 Rationale for Using Questionnaire Survey Method in this Research Study......91
3.11.5 Limitations of Survey Method as Primary Data Collection Method...........................92
3.12 Secondary Data Collection Methods..................................................................................93
3.12.1 Rationale for Selecting the Secondary Data Collection Methods .......................93
3.12.2 Secondary Data: Library Research Method.................................................................94
3.12.2.1 Rationale for Using Library Research Method in This Research......................94
3.12.4 Limitation of Literature Review as Secondary Data Collection Method....................95
3.13 Phases of Research under Data Collection of this Research Study....................................95
3.13.1 Description of Phase 1.................................................................................................95
3.13.2 Data Collection in Phase 1: Library Research Method...............................................96
3.13.3 Limitation of Phase 1...................................................................................................97
3.13.4 Description of Phase 2.................................................................................................99
3.13.5 Data Collection in Phase 2: Questionnaire Survey Method........................................99
3.13.5.1 Questionnaire Design for Survey.....................................................................100
3.14 Sample Size and Sample Technique................................................................................101
3.14.1 Rationale for Using Random Sampling Method.......................................................102

3.15 Pilot Study........................................................................................................................103
3.16 Data Analysis Approach......................................................................................................105
3.17 Rationale for Using Graphical Presentation Method.......................................................107
3.18 Authenticity, Bias, Validity and Reliability of the Research Study.................................110
3.19 Research Limitations........................................................................................................113
3.20 Summary..........................................................................................................................116
CHAPTER 4: DATA ANALYSIS .............................................................................................125
5 References ................................................................................................................................136

BACKGROUND INFORMATION
1 Introduction
Overview and structure
Introducing the thesis, this chapter will follow multiple phases. It starts by introducing an
overview of Arab region and information security importance, the nature of Arab trust and
culture, and the mismatch between western IT and local Arab IT which covers the whole
dissertation problem, and research objectives. Moreover, a short section that reflects on research
paradigms clarifying that this is an information system research paper. In addition, a personal,
non-academic section to explain the researcher’s background, motivation, and personal
determination. Finally, a short summary of what has been presented before proceeding to the
literature review chapter.
1.1Overview
1.1.1Overview of Arab Region
Arab is considered as a cultural term, and the term is used for the
people who speak Arabic and is their first language. It is found that Arab
people can be united on the basis of their cultural aspects and their history.
Within the Arab culture Muslims, Jewish and Christians can be found.
Therefore, it can be said that the people living in the Arab region are not
Muslims but also Jewish and Christians (ADC, 2009). The Arab region is also
considered as the Arab world, which consists of total 22 countries in the

Middle East region and North Africa. Some of the countries, which are
included in the Arab region, are Egypt, Iraq, Kuwait, Morocco, Qatar, Saudi
Arabia and the United Arab Emirates (ADC, 2009). It is found that Arab
countries have rich diversity in regard to the ethnic believes, linguistic
choices and also religious beliefs. Further, it has been observed that in the
Arab region, the link between Islam and Arab can be seen as the deep roots
of the history. The people living in the Arab region are found to speak Arabic,
and it is considered as the predominant religious language in the region. In
terms of life in the Arab region, it is found that in urban areas of Arab region
people have choices in occupations and freedom for women. Therefore, it
can be said that in the urban areas of an Arab region traditional pattern of
the people are changing. As compared to the urban life in the Arab region, it
is found that in rural areas, the cultural roots are found deep in the history
(ADC, 2009).
It is increasingly important to ensure high level of information security for
both individuals and organisations (Parson et al., 2014). IT security
guidelines are becoming highly advanced and user friendly. However,
employees are less likely to adhere to these guidelines which poses a serious
security risk and that make us wondering: are these guidelines adequate
enough for effective awareness? So a need for better understanding of what
could influence employees to comply and pay more attention to these
security guidelines. It is the main purpose of this research to identify the
factors that influence human behaviours in particularly the Arab region
towards information security such as the nature of Arab culture, trust, and
the mismatch with western IT Technology.
However, to extend more depth on this research, this thesis will cover the
nature of Arab trust and culture, and will conduct a statistical analysis after
collecting completed questionnaires from participants, to determine the

mismatch between western culture and Arab local culture and partially
personality factors and their impact on IS awareness training.
Despite the understanding of information security issues found in
organisations, researchers have explored the understanding of human
attitude and behaviour towards information security but there seems a lack
of research on how the understanding of the local culture may help us to
differentiate or isolate the issue that has been found within Arab culture such
as trust, information sharing culture, and resistance to western IT
Technology.
However, the focus of this research is narrow; it is only interested in the
nature of Arab trust towards information security, the local culture, the
mismatch between Arab local system and western based system, the
transfer of western technology to the Arab region challenges.
2 Information security and human behaviours
According to Siponen, Seppo, and Adam (Siponen, 2007), in the last few years, the importance
of information systems security has increased as witnessed by the number of incidents that
organisations have encountered. Employees rarely comply with the security policies, procedures,
and techniques which places the organisation assets in danger.
According to Inaugural International Conference on Human Aspects of Information Security and
Assurance, It is been acknowledged that the requirements of security can’t be addressed by
technical means only, and the important aspects of protection comes down to four dimensions,
attitude, awareness, behaviour, and capabilities of people involved, therefore employees or users
should be seen as a vital elements to build a successful security strategy (HAISA, 2007). Authors
such as Schneier, Pincus, and Heiser, stated that, in order to achieve an acceptable level of
information security within an organisation, human factor aspects should be considered as a
critical element rather than just focusing on software and hardware vulnerabilities (Schneier et
al., 2004).

Stanton, Stam, and Mastrangelo (Stanton et al., 2004) stated that information security research
focuses on algorithms, methods, and standards that support the three basic functions of
information security such as confidentiality, integrity, and availability (CIA). Concepts, theories,
and research that are relevant to human behaviour have been receiving increasing attention by
researchers on how human behaviour affects information security.
Binden, Jormae, Zain, and Ibrahim ( Binden et.al., 2014) suggest that protection of data and
critical information such as trade secrets and proprietary information is among the aspects that
have gained much emphasis recently due to the rising cases of infringement and theft of
confidential information from individuals and enterprises. Many of these infringements can be
attributed to human error.
According to NIST and Computer Security Act of 1987, the information integrity,
confidentiality, and availability of Federal agencies and organisations cannot be protected in
today’s highly networked systems environment without effective training and having users
involved understands the roles and responsibilities of their works and adequately train them to
perform them in more secure way (NIST, 1998).
In November 1989, the National Institute of Standards and Technology (NIST) working with
U.S. Office of Personnel Management (OPM) have developed and issued guidelines for Federal
computer security training. However, in January 1992, the Office of Personnel Management
(OPM) has issued a revision of federal personnel regulations related to the guidelines which were
voluntary and made them mandatory. As indicated by NIST, OPM regulations required training
for current employees, new hires within 60 days, a significant change in the IT security
environment or procedures of the agency, change positions of employees which deal with
sensitive information, and periodically as a refresher training for employees who handle sensitive
information.

Non-academic contribution
Overview of Wasta and Islam
This is a separate section I thought to include as I believe it is related to Arab culture in the real
life nowadays. As an observation, I have found that the Wasta is exists within Arab countries for
many years and as a results of that, the Wasta within Arabs becomes a key to build a
relationship at different level within their culture therefore the trust that this research is
addressing becomes vital to maintain their relationships. Much like China, the basic rule of
business in the Arab World is to establish a relationship first, build connections, and only
actually come to the heart of the intended business at a later meeting. There is a master
assumption that a network or web of connections already exists and the issues concern if, and
how, it may be accessed. In traditional Western models the emphasis is on the immediate
transaction itself. Thus in the Arab milieu much that subsequently transpires appears to be in
direct contrast to Western practice in which focus is placed on ‘getting the deal done’ and a
friendship- may only develop later as a separate function to the business transaction. Just as in
China, the Arab process of building relationships prior to transacting business is very time
consuming.
However, once a relationship has been established verbal contracts are absolute and an
individual’s word is his/her bond and failure to meet verbally agreed obligations will certainly
lead to a termination of a business relationship. Three factors are core to business and society in
the Arab World. Firstly, the global philosophy of Islam is based on practice rather than dogma.
Secondly, there is an expectation that good practice of Islam is what all Muslims do, Thirdly,
Muslim societies are wholly networked and all business activities revolve around these networks.
Like its Chinese counterpart guanxi, Wasta thus also involves a social network of interpersonal
connections rooted in family and kinship ties. Involving the exercise of power, influence and
information-sharing through social and politico-business networks, Wasta is intrinsic to the
operation of many valuable social processes, central to the transmission of knowledge, and the
creation of opportunity. Just as guanxi has a positive connotation of networking and negative
connotation of corruption, so too does Wasta and it is possible to refer to good Wasta and

negative Wasta. Though Sawalha (2002) suggests that Wasta, as the use of connections for
personal gains, commonly stands for nepotism, cronyism, and corruption in general, and, is a
deeply rooted practice among all segments of society and in all sectors, this was not the original
meaning of Wasta. Wasta is literally defined as Arabic for connections or pull and may be
utilised as a form of intercession or mediation. Traditionally, the head of the family in Arab
nations performed Wasta services by obtaining for the supplicant what is assumed to be
otherwise unattainable. In recent years, Wasta has come to mean the seeking of benefits from
government. Though Wasta pervades the culture of all Arab countries and is a force in all
significant decision making, it is not usually mentioned by most writers nor is it openly discussed
by Arabs themselves (Sawalha, 2002). By illustration one could point to a typical response to the
question of Wasta continued influence. A Western business person may ask an Arab colleague
whether Wasta is still influential in business transactions s/he will very probably at first say no
but then if the Westerner asks if Wasta will become irrelevant in Arab business and society, the
response will be an emphatic reply that Wasta is central to all Arab life. If the questioner
proceeds to express condemnation or dismay at the existence of Wasta in a specific business
situation they may be listened to courteously but discreetly humoured as possibly naïve or
inexperienced. But too much acceptance and understanding may also be taken as an adverse sign.
In principle Arabs are permitted to criticise Wasta in ways that from a Westerner would be
considered unacceptable. Thus HRD managers are advised to train their international managers
from a non-Arab background in the need to learning how to manage what may not be directly
acknowledged or discussed.
Cunningham and Sarayrah (1993) argue that Wasta has changed over time and its main goal has
shifted from conflict resolution as a means of survival to intercession, and the term denotes the
person who mediates/intercedes as well as the act of mediation/intercession (Cunningham and
Sarayrah, 1994). Intermediary Wasta endeavours to resolve inter-personal or inter-group conflict
and a jaha (wajaha', mediation group of notable emissaries sent by the perpetrator's family to the
victim's family) acts to inhibit revenge being taken following an incident involving personal
injury (Cunningham and Sarayrah, 1994). Wasta as mediation binds families and communities
for peace and well-being in a hostile environment and this form of Wasta benefits society as a
whole, as well as the parties involved (Cunningham and Sarayrah,1994). Intercessory Wasta
involves a protagonist intervening on behalf of a client to obtain an advantage for the client, such

as a job, a government document, a tax reduction, or admission to a prestigious university. In
instances where there are many seekers of the same benefit, only aspirants with the strongest
Wasta are successful (Cunningham and Sarayrah, 1994). In Western business it is common to
negotiate with only one organisation at a time after initial quotes have been received. In the Arab
World negotiations will be conducted with several businesses simultaneously and the
organisation to win the deal will usually be the one with the strongest Wasta connections. The
lesson for international managers is to avoid placing all their efforts on the product/service
delivery but rather to invest their time and resources in the requisite business acumen of
cultivating strong connections. In this context there is no substitute for achieving a good
reputation for honest dealing. Western managers may come unstuck if they presume to act as
they believe local managers from an Arab background might behave. Indeed, any inference
relating to such topics as “corruption” may be very bitterly resented.
3.1Trust
It has been argued that attempts to regulate traditional forms of networking, particularly the Arab
Wasta, by legal or juridical constraint usually fail because they are intrinsically tied to trust and
social structures and family connections (Weir, 2003a). For the Chinese, emotional trust is more
important than cognitive trust, and is based on sentiment-based ties between individuals which
may also be extended to others through the relationship network, guanxiwang (Gao and Ting-
Toomey, 1998). Xinyong (trust) literally means the use or usefulness of trust but also refers to
the integrity, credibility, trustworthiness, or the reputation and character of a person (Kiong and
Kee,1998). Moreover, when an individual helps one’s guanxi, that individual’s reputation is
raised and trust and mianzi (face) won from others. Trust is also associated with the importance
of one’s word over legal documents. When trust has been established, one’s word can be taken in
business transactions – to go against one’s given word is to lose face and trust and ultimately
one’s good guanxi. Reciprocity is also linked to guanxi and trust with an unwritten rule that one
must Payback + 1 when a favour has been provided. Relations of trust between business partners
are integral to successful business transactions in the Arab World also. While the Western world
relies on formal agreements and legally-prepared and signed contracts, once a trustful

relationship has been established in the Arab World business partners need only give their word
of honour in business dealings (Demirbag, Mirza and Weir, 2003). Consultation or Shura is
central to business relationship in the Arab World (Siddiqui, 1997) and decisions carry great
importance as they are deemed to have been made on behalf of Allah. Though trust is endemic to
business and social relationships, participation is a key and consultation means the right to
appeal decisions (Espisito, 1988). While trust in China hails from Confucian philosophy, trust in
the Arab World is rooted in Islam and faith in God. It should be noted, though, that while the
word of an Arab is his/her bond, the phrase ‘Insha’Allah’, literally “if God wills it” can be a
simple statement or a form of words covering the strong possibility of inaction or even a negative
outcome to apparently agreed courses of action. Weir (2003a) argues that, by its very nature, this
is an indefeasible expression, for all outcomes represent the will of God and what eventually
happens, or does not happen, is equally an expression of Divine will. The successful
international manager is one who recognises this pre-existing state and who works slowly but
surely towards gaining the trust of his/her Chinese and Arab counterparts.
3.2 The importance of family
Family is of central importance in both China and the Arab World. In China, the notion of family
encompasses the extended family and the wider community. Not only do people feel a sense of
obligation to their family, but also an obligation to save and maintain face for their family and
extended networks. Reciprocal obligations are not limited to family and kinship only but also to
non-kin ties in which people are expected to help each other as if they are fulfilling obligations to
their family members (Bian and Ang, 1997). This reciprocity is integrally tied to guanxi and
further extended to the repayment of business and social deeds, and those that fail to deliver, may
be “labelled as bugou pengyou, or ‘not enough of a friend’” (Seligman, 1999, p. 36). Family
forms the basis of business organisation even more so in the Arab World than China. Moreover,
the family in the Arab World is the primary Wasta channel (Muna, 1980). The formalities of
social, family and political life are strictly preserved, even in managerial settings. Just as Chinese
business culture revolves around banqueting, it is impossible to undertake any kind of meeting in
an Arab organisation without the ubiquitous coffee or tea rituals associated with the ‘diwan’. The
traditional tribal Wasta, the shaykh, was a man of honour, whose word was his bond and whom
would assume responsibility for his acts (Cunningham and Sarayrah, 1994).