Analyzing Information Security Behaviors in the Arab Region

This thesis investigates the influence of Arab culture on information security behaviors, focusing on the role of trust, cultural norms, and the adoption of Western IT technologies in the Arab region. It begins with an overview of the Arab region and the importance of information security, highlighting the mismatch between Western IT systems and local Arab IT practices. The research delves into the concepts of 'Wasta' and Islamic principles, examining their impact on trust and relationships within the Arab culture. A comprehensive literature review explores culture, trust dynamics, and personality types, further analyzing the effects of personality traits on attitudes toward information security. The methodology chapter outlines the research questions, methods, and approaches, including both qualitative and quantitative methods for data collection, utilizing questionnaire surveys and library research. The study also addresses authenticity, bias, validity, and reliability, concluding with a discussion of research limitations.

Contents
1 Introduction...................................................................................................................................4
1.1Overview.................................................................................................................................4
1.1.1Overview of Arab Region................................................................................................4
2 Information security and human behaviours................................................................................6
3 Non-academic contribution......................................................................................................7
Overview of Wasta and Islam..........................................................................................................7
3.1Trust......................................................................................................................................10
3.2 The importance of family.....................................................................................................11
4 Literature review.........................................................................................................................13
Overview and structure..............................................................................................................13
4.1 Objectivise and orientation..................................................................................................13
4.1.1Culture............................................................................................................................14
4.1.2 Trust dynamics..............................................................................................................15
4.1.4 Mismatch with western IT Technology.........................................................................15
4.1.5 Personality types............................................................................................................16
5 Introduction.................................................................................................................................16
Overview........................................................................................................................................16
5.1 Overview of Personality, Trust and Culture within Arab Region........................................17
5.2 Cultural similarity................................................................................................................19
5.3 Research in Culture by Hofstede.........................................................................................22
5.4 Trust.....................................................................................................................................24

5.4.1 Trust and Relationships.................................................................................................24
5.4.2 Arab cultural antecedents of trust..................................................................................26
5.4.3 The Universal Approach towards Trust........................................................................28
5.4.4 Openness to Communication.........................................................................................29
5.4.5 Relationship on Sharing Information............................................................................29
5.4.6 Variables of Shared Culture, Environment and Values in Communication..................30
5.4.7 Style of Management in the Arab world.......................................................................32
5.4.8 Trust in Diversity...........................................................................................................32
5 .5 Western Information Technology.......................................................................................34
5.6 Attitudes affecting the information security behaviours......................................................36
5.7 Personality Factors effects on attitude towards information security..................................46
5.7.1 Neuroticism...................................................................................................................48
5.7.2 Extraversion –Introversion............................................................................................49
5.7.3 Openness.......................................................................................................................49
5.7.4 Agreeableness................................................................................................................50
5.7.5 Conscientiousness.........................................................................................................50
5.8 Personality traits, Information sharing, and Trust................................................................50
3 Methodology chapter..................................................................................................................53
3.1 Research Questions..............................................................................................................53
3.2 Methods and Approaches.....................................................................................................56
3.3 Proposed methods................................................................................................................57
3.3 Rational selection for methodology.....................................................................................75
3.4 Research Paradigm...............................................................................................................77
3.5 Rationale for the Selection of Interpretivism Research Paradigm.......................................79
3.6 Research Design...................................................................................................................80

3.7 Rationale for the Selection of Exploratory Research Design..............................................80
3.8 Use of Mixed Methods- Qualitative and Quantitative.........................................................81
3.9 Research Approach..................................................................................................................81
3.10 Rationale for the Selection of Inductive Research Approach............................................82
3.11 Data Collection Methods.......................................................................................................82
3.11.1 Primary Data Collection Method................................................................................83
3.11.2 Rationale for Choosing the Primary Data Collection Methods...................................83
3.11.3 Primary Data: Questionnaire Survey Method.............................................................84
3.11.5 Limitations of Survey Method as Primary Data Collection Method...........................85
3.12 Secondary Data Collection Methods..................................................................................85
3.12.1 Rationale for Selecting the Secondary Data Collection Methods...............................86
3.12.2 Secondary Data: Library Research Method................................................................86
3.12.4 Limitation of Literature Review as Secondary Data Collection Method....................87
3.13 Phases of Research under Data Collection of this Research Study...................................87
3.13.1 Description of Phase 1.................................................................................................87
3.13.2 Data Collection in Phase 1: Library Research Method...............................................88
3.13.3 Limitation of Phase 1..................................................................................................89
3.13.4 Description of Phase 2.................................................................................................90
3.13.5 Data Collection in Phase 2: Questionnaire Survey Method........................................90
3.14 Sample Size and Sample Technique..................................................................................92
3.14.1 Rationale for Using Random Sampling Method.........................................................92
3.15 Pilot Study..........................................................................................................................93
3.16 Data Analysis Approach........................................................................................................95
3.17 Rationale for Using Graphical Presentation Method.........................................................96
3.18 Authenticity, Bias, Validity and Reliability of the Research Study...................................99

3.19 Research Limitations........................................................................................................101
3.20 Summary..........................................................................................................................104
5 References.................................................................................................................................111
BACKGROUND INFORMATION

1 Introduction
Overview and structure
Introducing the thesis, this chapter will follow multiple phases. It starts by introducing an
overview of Arab region and information security importance, the nature of Arab trust and
culture, and the mismatch between western IT and local Arab IT which covers the whole
dissertation problem, and research objectives. Moreover, a short section that reflects on research
paradigms clarifying that this is an information system research paper. In addition, a personal,
non-academic section to explain the researcher’s background, motivation, and personal
determination. Finally, a short summary of what has been presented before proceeding to the
literature review chapter.
1.1Overview
1.1.1Overview of Arab Region
Arab is considered as a cultural term, and the term is used for the people who speak
Arabic and is their first language. It is found that Arab people can be united on the basis of their
cultural aspects and their history. Within the Arab culture Muslims, Jewish and Christians can be
found. Therefore, it can be said that the people living in the Arab region are not Muslims but also
Jewish and Christians (ADC, 2009). The Arab region is also considered as the Arab world,
which consists of total 22 countries in the Middle East region and North Africa. Some of the
countries, which are included in the Arab region, are Egypt, Iraq, Kuwait, Morocco, Qatar, Saudi
Arabia and the United Arab Emirates (ADC, 2009). It is found that Arab countries have rich
diversity in regard to the ethnic believes, linguistic choices and also religious beliefs. Further, it
has been observed that in the Arab region, the link between Islam and Arab can be seen as the
deep roots of the history. The people living in the Arab region are found to speak Arabic, and it

is considered as the predominant religious language in the region. In terms of life in the Arab
region, it is found that in urban areas of Arab region people have choices in occupations and
freedom for women. Therefore, it can be said that in the urban areas of an Arab region traditional
pattern of the people are changing. As compared to the urban life in the Arab region, it is found
that in rural areas, the cultural roots are found deep in the history (ADC, 2009).
It is increasingly important to ensure high level of information security for both individuals and
organisations (Parson et al., 2014). IT security guidelines are becoming highly advanced and user
friendly. However, employees are less likely to adhere to these guidelines which poses a serious
security risk and that make us wondering: are these guidelines adequate enough for effective
awareness? So a need for better understanding of what could influence employees to comply
and pay more attention to these security guidelines. It is the main purpose of this research to
identify the factors that influence human behaviours in particularly the Arab region towards
information security such as the nature of Arab culture, trust, and the mismatch with western IT
Technology.
However, to extend more depth on this research, this thesis will cover the nature of Arab trust
and culture, and will conduct a statistical analysis after collecting completed questionnaires from
participants, to determine the mismatch between western culture and Arab local culture and
partially personality factors and their impact on IS awareness training.
Despite the understanding of information security issues found in organisations, researchers have
explored the understanding of human attitude and behaviour towards information security but
there seems a lack of research on how the understanding of the local culture may help us to
differentiate or isolate the issue that has been found within Arab culture such as trust,
information sharing culture, and resistance to western IT Technology.
However, the focus of this research is narrow; it is only interested in the nature of Arab trust
towards information security, the local culture, the mismatch between Arab local system and
western based system, the transfer of western technology to the Arab region challenges.

2 Information security and human behaviours
According to Siponen, Seppo, and Adam (Siponen, 2007), in the last few years, the importance
of information systems security has increased as witnessed by the number of incidents that
organisations have encountered. Employees rarely comply with the security policies, procedures,
and techniques which places the organisation assets in danger.
According to Inaugural International Conference on Human Aspects of Information Security and
Assurance, It is been acknowledged that the requirements of security can’t be addressed by
technical means only, and the important aspects of protection comes down to four dimensions,
attitude, awareness, behaviour, and capabilities of people involved, therefore employees or users
should be seen as a vital elements to build a successful security strategy (HAISA, 2007). Authors
such as Schneier, Pincus, and Heiser, stated that, in order to achieve an acceptable level of
information security within an organisation, human factor aspects should be considered as a
critical element rather than just focusing on software and hardware vulnerabilities (Schneier et
al., 2004).
Stanton, Stam, and Mastrangelo (Stanton et al., 2004) stated that information security research
focuses on algorithms, methods, and standards that support the three basic functions of
information security such as confidentiality, integrity, and availability (CIA). Concepts, theories,
and research that are relevant to human behaviour have been receiving increasing attention by
researchers on how human behaviour affects information security.
Binden, Jormae, Zain, and Ibrahim ( Binden et.al., 2014) suggest that protection of data and
critical information such as trade secrets and proprietary information is among the aspects that
have gained much emphasis recently due to the rising cases of infringement and theft of
confidential information from individuals and enterprises. Many of these infringements can be
attributed to human error.
According to NIST and Computer Security Act of 1987, the information integrity,
confidentiality, and availability of Federal agencies and organisations cannot be protected in
today’s highly networked systems environment without effective training and having users

involved understands the roles and responsibilities of their works and adequately train them to
perform them in more secure way (NIST, 1998).
In November 1989, the National Institute of Standards and Technology (NIST) working with
U.S. Office of Personnel Management (OPM) have developed and issued guidelines for Federal
computer security training. However, in January 1992, the Office of Personnel Management
(OPM) has issued a revision of federal personnel regulations related to the guidelines which were
voluntary and made them mandatory. As indicated by NIST, OPM regulations required training
for current employees, new hires within 60 days, a significant change in the IT security
environment or procedures of the agency, change positions of employees which deal with
sensitive information, and periodically as a refresher training for employees who handle sensitive
information.
3 Non-academic contribution
Overview of Wasta and Islam
This is a separate section I thought to include as I believe it is related to Arab culture in the real
life nowadays. As an observation, I have found that the Wasta is exists within Arab countries for
many years and as a results of that, the Wasta within Arabs becomes a key to build a
relationship at different level within their culture therefore the trust that this research is
addressing becomes vital to maintain their relationships. Much like China, the basic rule of
business in the Arab World is to establish a relationship first, build connections, and only
actually come to the heart of the intended business at a later meeting. There is a master
assumption that a network or web of connections already exists and the issues concern if, and
how, it may be accessed. In traditional Western models the emphasis is on the immediate
transaction itself. Thus in the Arab milieu much that subsequently transpires appears to be in
direct contrast to Western practice in which focus is placed on ‘getting the deal done’ and a
friendship- may only develop later as a separate function to the business transaction. Just as in

China, the Arab process of building relationships prior to transacting business is very time
consuming.
However, once a relationship has been established verbal contracts are absolute and an
individual’s word is his/her bond and failure to meet verbally agreed obligations will certainly
lead to a termination of a business relationship. Three factors are core to business and society in
the Arab World. Firstly, the global philosophy of Islam is based on practice rather than dogma.
Secondly, there is an expectation that good practice of Islam is what all Muslims do, Thirdly,
Muslim societies are wholly networked and all business activities revolve around these networks.
Like its Chinese counterpart guanxi, Wasta thus also involves a social network of interpersonal
connections rooted in family and kinship ties. Involving the exercise of power, influence and
information-sharing through social and politico-business networks, Wasta is intrinsic to the
operation of many valuable social processes, central to the transmission of knowledge, and the
creation of opportunity. Just as guanxi has a positive connotation of networking and negative
connotation of corruption, so too does Wasta and it is possible to refer to good Wasta and
negative Wasta. Though Sawalha (2002) suggests that Wasta, as the use of connections for
personal gains, commonly stands for nepotism, cronyism, and corruption in general, and, is a
deeply rooted practice among all segments of society and in all sectors, this was not the original
meaning of Wasta. Wasta is literally defined as Arabic for connections or pull and may be
utilised as a form of intercession or mediation. Traditionally, the head of the family in Arab
nations performed Wasta services by obtaining for the supplicant what is assumed to be
otherwise unattainable. In recent years, Wasta has come to mean the seeking of benefits from
government. Though Wasta pervades the culture of all Arab countries and is a force in all
significant decision making, it is not usually mentioned by most writers nor is it openly discussed
by Arabs themselves (Sawalha, 2002). By illustration one could point to a typical response to the
question of Wasta continued influence. A Western business person may ask an Arab colleague
whether Wasta is still influential in business transactions s/he will very probably at first say no
but then if the Westerner asks if Wasta will become irrelevant in Arab business and society, the
response will be an emphatic reply that Wasta is central to all Arab life. If the questioner
proceeds to express condemnation or dismay at the existence of Wasta in a specific business
situation they may be listened to courteously but discreetly humoured as possibly naïve or
inexperienced. But too much acceptance and understanding may also be taken as an adverse sign.

In principle Arabs are permitted to criticise Wasta in ways that from a Westerner would be
considered unacceptable. Thus HRD managers are advised to train their international managers
from a non-Arab background in the need to learning how to manage what may not be directly
acknowledged or discussed.
Cunningham and Sarayrah (1993) argue that Wasta has changed over time and its main goal has
shifted from conflict resolution as a means of survival to intercession, and the term denotes the
person who mediates/intercedes as well as the act of mediation/intercession (Cunningham &
Sarayrah, 1994). Intermediary Wasta endeavours to resolve inter-personal or inter-group conflict
and a jaha (wajaha', mediation group of notable emissaries sent by the perpetrator's family to the
victim's family) acts to inhibit revenge being taken following an incident involving personal
injury (Cunningham & Sarayrah, 1994). Wasta as mediation binds families and communities for
peace and well-being in a hostile environment and this form of Wasta benefits society as a
whole, as well as the parties involved (Cunningham & Sarayrah,1994). Intercessory Wasta
involves a protagonist intervening on behalf of a client to obtain an advantage for the client, such
as a job, a government document, a tax reduction, or admission to a prestigious university. In
instances where there are many seekers of the same benefit, only aspirants with the strongest
Wasta are successful (Cunningham & Sarayrah, 1994). In Western business it is common to
negotiate with only one organisation at a time after initial quotes have been received. In the Arab
World negotiations will be conducted with several businesses simultaneously and the
organisation to win the deal will usually be the one with the strongest Wasta connections. The
lesson for international managers is to avoid placing all their efforts on the product/service
delivery but rather to invest their time and resources in the requisite business acumen of
cultivating strong connections. In this context there is no substitute for achieving a good
reputation for honest dealing. Western managers may come unstuck if they presume to act as
they believe local managers from an Arab background might behave. Indeed, any inference
relating to such topics as “corruption” may be very bitterly resented.
3.1Trust

It has been argued that attempts to regulate traditional forms of networking, particularly the Arab
Wasta, by legal or juridical constraint usually fail because they are intrinsically tied to trust and
social structures and family connections (Weir, 2003a). For the Chinese, emotional trust is more
important than cognitive trust, and is based on sentiment-based ties between individuals which
may also be extended to others through the relationship network, guanxiwang (Gao & Ting-
Toomey, 1998). Xinyong (trust) literally means the use or usefulness of trust but also refers to
the integrity, credibility, trustworthiness, or the reputation and character of a person (Kiong &
Kee,1998). Moreover, when an individual helps one’s guanxi, that individual’s reputation is
raised and trust and mianzi (face) won from others. Trust is also associated with the importance
of one’s word over legal documents. When trust has been established, one’s word can be taken in
business transactions – to go against one’s given word is to lose face and trust and ultimately
one’s good guanxi. Reciprocity is also linked to guanxi and trust with an unwritten rule that one
must Payback + 1 when a favour has been provided. Relations of trust between business partners
are integral to successful business transactions in the Arab World also. While the Western world
relies on formal agreements and legally-prepared and signed contracts, once a trustful
relationship has been established in the Arab World business partners need only give their word
of honour in business dealings (Demirbag, Mirza & Weir, 2003). Consultation or Shura is
central to business relationship in the Arab World (Siddiqui, 1997) and decisions carry great
importance as they are deemed to have been made on behalf of Allah. Though trust is endemic to
business and social relationships, participation is a key and consultation means the right to
appeal decisions (Espisito, 1988). While trust in China hails from Confucian philosophy, trust in
the Arab World is rooted in Islam and faith in God. It should be noted, though, that while the
word of an Arab is his/her bond, the phrase ‘Insha’Allah’, literally “if God wills it” can be a
simple statement or a form of words covering the strong possibility of inaction or even a negative
outcome to apparently agreed courses of action. Weir (2003a) argues that, by its very nature, this
is an indefeasible expression, for all outcomes represent the will of God and what eventually
happens, or does not happen, is equally an expression of Divine will. The successful
international manager is one who recognises this pre-existing state and who works slowly but
surely towards gaining the trust of his/her Chinese and Arab counterparts.

3.2 The importance of family
Family is of central importance in both China and the Arab World. In China, the notion of family
encompasses the extended family and the wider community. Not only do people feel a sense of
obligation to their family, but also an obligation to save and maintain face for their family and
extended networks. Reciprocal obligations are not limited to family and kinship only but also to
non-kin ties in which people are expected to help each other as if they are fulfilling obligations to
their family members (Bian & Ang, 1997). This reciprocity is integrally tied to guanxi and
further extended to the repayment of business and social deeds, and those that fail to deliver, may
be “labelled as bugou pengyou, or ‘not enough of a friend’” (Seligman, 1999, p. 36). Family
forms the basis of business organisation even more so in the Arab World than China. Moreover,
the family in the Arab World is the primary Wasta channel (Muna, 1980). The formalities of
social, family and political life are strictly preserved, even in managerial settings. Just as Chinese
business culture revolves around banqueting, it is impossible to undertake any kind of meeting in
an Arab organisation without the ubiquitous coffee or tea rituals associated with the ‘diwan’. The
traditional tribal Wasta, the shaykh, was a man of honour, whose word was his bond and whom
would assume responsibility for his acts (Cunningham & Sarayrah, 1994).
Although originally based upon family loyalty, Wasta relationships have expanded to
encompass the broader community of friends and acquaintances as does guanxi in China. It is
further argued that Wasta -based recruitment and allocation of benefits reinforce family ties,
thereby connecting the individual to the economy and polity. Indeed, Cunningham & Sarayrah
(1994) and Weir (2003a) proffer that the importance of family connections is so great that how
people are admitted to university or hired for a job is less important than their performance in
class or on the job. Moreover, where a close family member appears at the office of even quite a
senior manager, it is regarded as improper for the demands of organisational hierarchy to take
precedence over the obligations due to family (Sulieman 1984). International managers can
never assume the position of a close family member but they are advised to work with Chinese
and Arab middle managers and business partners as intermediaries to form a more trustful bond
with their employees and business associates. In so doing they can work towards a situation of
insider status and knowledge sharing which will be of long-term profit to their organisation
Favours. In both China and the Arab World the notion of favours is tied to guanxi and Wasta
respectively. Yet, while the Chinese differentiate between favours that support guanxi