Organisational Factors and Australian IT Professionals’ Views of Wireless Network Vulnerability Assessments Keir Dyce Centre for Research in Computer Security & Professor Mary Barrett School of Management and Marketing

Organisational culture: issues for computer security Professional Identity Sub-groups External and internal influences on culture Attitudes to risk Attitudes to surveillance ALL POTENTIALLY HAVE AN IMPACT ON WLAN SECURITY

Two approaches to wireless network vulnerability assessment Wireless monitoring (WM) Penetration testing (PT) No comprehensive framework for integrating the two approaches in an organisation’s security system

The study mail-out survey to Information Security Interest Group (ISIG), closed-ended and open-ended questions, frequencies only Topics covered: 1. the extent of use of WNVAs, (either or both wireless monitoring and penetration testing), 2. how IT professionals used WNVAs, and 3. their opinions about the two approaches

Results Modest response rate (62), but representative of ISIG (total ~400 members) 1 Use of VAs: Only ten (16 percent) used WM, three (5 percent) used PT. ‘Unnecessary’, ‘lack know-how’. Org’l culture suggests: ‘Wired view’ of security, senior management discomfort with idea of hacking Role of dominant culture and sub-cultures

Results (continued) 2 How IT professionals use WNVAs 10 users; but using either WM or PT or a combination of the two had revealed network vulnerabilities. Lack of a framework for combining the two. Respondents said this could be helpful to increase know-how. ‘Planning’ thought to be helpful, but scarcely anyone does this. (Only 1 of the 10 users has researched a framework.)

Results (continued) 3 Possible reasons for IT professionals’ low use of WNVAs Decision-making style, esp Bounded rationality in response to time constraints Secrecy may be provoked by time needed to get support from people who don’t understand WNVA techniques, and who are suspicious of surveillance measures, and lack of perceived need. Could lead to ethical compromises by IT staff.

Conclusions Organisational culture may help explain why IT professionals typically don’t use either kind of WNVA or even seem to know about them. ‘Within-culture’ solutions: change security measures and communicate. ‘Change culture’ solutions: reward new behaviour, use stories, use professional identity.