An activity theory analysis of factorsm influencing information security practices in software organisations

Abstract

Information is an asset to any organisation. As a result, different organisations strive to ensure that information is well protected. This has led to organisations creating information security policies Despite this approach, employees play a vital role to ensure that these policies are implemented. Information security has been studied in different contexts. However, in the existing literature, there is limited research which investigates the factors that influence information security practices in the context of software organisations. Similar to other business contexts, information is an important tool within software organisations. The purpose of this study was to investigate the factors that influence information security practices in software organisations using a Namibian software organisation as a case study. The use of Activity Theory as a lens helped to investigate the factors that influence information security practices in software organisations which are often overlooked. From the analysis of the findings, it is evident that factor such as employee structure, work context, information sensitivity, reputation, responsibility, accountability and policies influence information security practices in software organisations. The findings revealed that information security policies have to been forced at different levels and units in software organisations. The findings from this study may assist software organisations when implementing information security policies.