Culture and information security: outsourcing IT services in China

With the rapid decline of communication costs, a decentralization of societies, businesses and information systems is taking place. Teleworking and outsourcing are two outcomes of this development. Due to this fundamental system transformation, traditional security concepts based on technical and organizational measures are not sufficient anymore. The human factor plays an increasingly important role. The influence of human behavior on information security needs to be properly addressed. Teleworking and outsourcing lead to growing information asymmetries between managers and their employees as well as companies and their outsourcing providers. This gap can be reduced by analyzing human behavior. Recently, the integration of concepts from social sciences has started this thinking process. Economics and psychology are two research branches that are followed by security researchers. However, as a result of globalization, many corporations have become multicultural and outsourcing takes place on a global scale. Therefore, a profound understanding of cultural characteristics and the impact of culture on information security is crucial for bridging the information gap. In the Chinese outsourcing market, this information gap is most evident. Managers are afraid of outsourcing their IT services within or even to China. They face the obstacle to judge the intention and quality of Chinese outsourcing providers. Furthermore, they are worried about the unstable environment and unknown cultural characteristics. By conducting research in the Chinese outsourcing and security industry, I have scrutinized whether this fear is justified. In this thesis, I thoroughly examine the Chinese outsourcing environment and analyze the impact of culture on information security. Therefore, I apply concepts from the discipline of cultural studies to security problems. I use Geert Hofstede’s cultural dimensions to compare national cultures and to analyze their impact on information security. Moreover, I build on Edward T. Hall’s work on intercultural communication to evaluate how cultural differences can endanger outsourcing deals. My observations of the Chinese environment are not limited to the outsourcing market. They include many insights that are relevant to anyone doing business in China. The findings on the impact of culture on information security are even more generic and independent of the country. They enhance our understanding of the human factor in information security. These observations reveal valuable insights that are necessary for managing security risks. Analyzing human behavior in order to manage security risks is an approach that can directly be applied and will be followed in the next one or two decades. In the long run, information security needs a fundamental change. As societies, businesses and information systems have transformed from isolated entities to hierarchical structures to decentralized systems, information security strategies eventually need to make this last step as well. Gathering more and more information will help decision makers to obtain a clearer picture. With more knowledge, they become able to better regulate the system. However, as with political and economic systems, security managers cannot gather an infinite amount of information which would be necessary to regulate highly decentralized systems. Eventually, we need a market mechanism in information security that regulates in form of Adam Smith’s invisible hand. Until then, my thesis adds an important jigsaw piece to the analytical toolbox of security and risk managers.