## 2 State of the Art
### Researches about the Security Culture
#### Proposal of [PERSON] [48] proposes the construction of an ISMS that is oriented towards SMEs and whose central point is the security culture. This is done by analyzing the state of SMEs in Australia, after which the conclusion is reached that that the information security risks for Australian SMEs have increased over the last 15 years as the result of greater access to the Internet, but that the level of information security and awareness in SMEs has not maintained a good rhythm and continues to be low. This proposal does not enter into the mechanisms by which the ISMS can be employed, nor does it mention aspects such as the controls, metrics and risk management that it should contain, but rather focuses solely on the elements that a security culture ISMS should contain. The principal causes of the security management problems detected in the SMEs were:* SMEs view the information system as a system that supports the company's production departments and not as something that is vital for their business. This makes them reactive rather than proactive to security failures. * For SMEs, cost is fundamental, and they view security as an unjustified expense. * The managers are not concerned about security and neither, therefore, are the other employees. * Users find it very difficult to fulfill this framework. What is more, it is very difficult to change the bad habits acquired, and none of the users wish to be responsible for the information security system assets. * Initiatives should be appropriately managed, and the policies and procedures should be presented to users when they sign their contracts. This may be more difficult for SMEs, since they lack formal organizational structures. It is also important to consider the fulfillment of security within the evaluation of the employees' work. * The lack of appropriate information as regards security. Those surveyed considered e-learning to be a valid work tool with which to improve the level of the information security culture, as was the possibility of being able to share experiences with other SMEs. The problem is, however, that it is not normally possible for the workers at SMEs to go on courses for reasons of time and money, and many workers do not take these courses if there is no motivation for them to do so. [PERSON] [48] proposed that these problems should be dealt with by constructing an ISMS that was oriented towards the development of an information systems security culture, and which should consider how people think and behave, thus suggesting the need for an interpretative research approach. The model was validated in four groups, following the [PERSON] [60] principles. Several frameworks and approaches were used to develop a valid theory, after which a set of SMEs were analyzed with the intention of determining their security consciousness, the challenges confronted by SMEs as regards fomenting an information security culture and the viability of the pre-project. This framework is formed of the following elements:  
* Organizational and individual learning: The information security culture should be disseminated throughout all levels of the organization at both an individual and a collective level [31]. According to [PERSON] [55], it might be useful to employ an organizational learning approach. * E-Learning (cooperation, collaboration and the exchange of knowledge): SMEs could undertake electronic learning (e-learning) [61], and could also cooperate and collaborate electronically in information system security communities and forums [42] with the objective of improving the information system users' security culture. * Management: Awareness-raising programmes (supported by the management, threats of disciplinary measures, clauses in employment contracts, etc. ), training, education or the value of leadership [62] are valuable initiatives for the development of the information security culture [12; 54]. It is probable that different levels of awareness raising, training and educational needs are generated for the individual employees in SMEs.