![](bg7.png)
government. Which is seen in the quantity and
quality of legislation that addresses IS security and
data protection in the UAE versus other countries
such as the UK or versus other types of legislation.
The UAE has only one law that was issued in 2006
to address cyber crimes. This law is young,
immature, and yet to be challenged. The UAE court
system has not witnesses a single case where one of
the government institutions was accused of liability
for data exposure.
It is the conclusion of the authors, and in correlation
with the findings of (Mitnick, 2002), and
(Puhakainen, 2006), that the following steps have
the potential to increase the level of IS security
awareness, and consequently the level of IS security
in UAE higher education: (a) Establishment of IS
security policies and procedures; (b) Campaign IS
security awareness best practices and advertise IS
security training sessions and materials; (c) Train
users on IS security best practices to increase their
awareness; (d) Practice reward and punishment.; and
(e) Conduct continuous evaluation and readjustment.
7 CONCLUSIONS
This paper explores the level of IS security
awareness of IS users in UAE higher education and
compares it to that of IS users in UK higher
education. The findings of this study indicate that
despite the fact that the IS infrastructure of the
examined institutions is relatively comparable, the
level of IS security awareness of IS users in the
UAE was considerably lower than that of IS users in
the UK. This gap of IS security awareness can
directly be linked to the level of organization
commitment to IS security awareness activities in
the case of the UK, and the lack thereof in the case
of the UAE. The organization’s commitment to IS
security awareness in the case of the UK could be
represented by the establishment, communication,
and enforcement of IS security awareness measures
such as IS security policies, IS security training, IS
security documentations, and IS security
coordination. While none of these measures were
found in the case of the UAE. This organization’s
level of commitment to IS security awareness is also
a indication of the organization’s perceived value of
the data it stores. While some of these findings may
sound basic in nature. In retrospect, they appear to
be something that you would fundamentally expect
to be addressed in any higher education institution
that aspires for international accreditation and
recognition.
REFERENCES
Abdullah, A., 2004. The Development of Electronic
Journals in the United Arab Emirates University
(UAEU).
Barrage, G., Majdalani, F., Vayanos, P., and Shehadi,
R.,2003. Information Technology in the Middle East:
The CEO Agenda. Booz, Allen, and Hamilton.
Bonoma TV., 1985. Case Research in Marketing:
Opportunities, Problems, and a Process. Journal of
Marketing research. 22:199-208.
Bray TJ., 2002. Security actions during reduction in
workforce efforts: what to do when downsizing.
Information system security. 11-15.
Cooper, M., 2009. Information Security Training- Lessons
Learned Along the Trail. Proceedings of the 36th
annual ACM SIGUCCS conference on User services
conference. 207-212.
Dlimini, M. T., Eloff, J. H. P., and Eloff, M. M., 2008.
Information security: The moving target. Computers &
Security.
Denzin, N. K., & Lincoln, Y. S. (Eds.), 2000. The
handbook of qualitative research. (2nd ed.). London:
SAGE Publishing.
Dunlop, C. &Kling, R. Social Relationship in Electronic
Commerce., 1992. Introduction in Computerization
and Controversy- Value Conflicts and Social change,
(ed. C. Dunlop and R. Kling). Academic Press, New
York, USA.
EDUCAUSE center for Applied Research: Information
Technology Security: 2003. Governance, strategy, and
practice in Higher Education.
Emirates Today. UAE Rank 46th Globally as Originator
on Phishing Attacks. Retrieved 22, March, 2007 from
http://www.ameinfo.com/56212.html.
Goodman, S.E., 1991. Computing in a less developed
country. Communications of the ACM, 34, 12, 25-29.
ISACA. Information Systems Audit and Control
Association., 2006. Information Systems Auditing
Manual.
ISF- International Security Forum., 2005. The Forum's
Standard of Good Practice for IS security. Cited May
18th 2006 from
http://www.isfsecuritystandard.com/index_ie.htm.
Joseph, M., 2006. IT in the Middle East: Overview.
Proceedings of the 7th conference on Information
technology education.
Katz, FH., 2005. The Effect of a University Information
Security Survey on Instructing Methods in
Information Security. In: Proceedings of the 2nd
annual conference on Information security curriculum
development. p.43-48.
Kostopoulos, G., 2003. E-Government of the Arabian
Gulf: A vision Toward Reality. ACM International
Conference Proceeding Series; Vol. 130.
Kovacich GL., 1998. Information system security Officer's
Guide: Establishing and Managing an Information
Protection Program. USA: Butterworth-Heinemann.
INFORMATION SECURITY AWARNESS IN DIFFERENT HIGHER EDUCATION CONTEXTS - A Comparative
Study
221