Identification of the Employee's Mental Patterns about the Policies of Information Security

The security of information systems is one of the most important challenges for today's organizations. Although most organizations use security technologies, they concluded that technology is not enough by itself and the key threat to the organization security comes from employees who do not agree with the organization security policies. Therefore, the field of end users security behaviors in the organization has received serious attention. In accordance with recent studies, end users have different security perspectives which have weakened the monitoring of user's security behaviors. Using Q methodology, this research attempted to identify employees’ mental patterns regarding information security policies to lead employees with the security requirements of the organization. In this regard, by reviewing previous researches as well as evaluating and summing up the discourse space, Q statements were selected and ranked by 31 employees of petroleum products Distribution Company. Constantly, analysis statements and four mental patterns were identified and classified as assessors, committed, relatives and people who consider deterrence tools helpful in line with information security policies.