Security Culture in Sweden with Focus on Digital Certificate Culture in Organizations

Sammanfattning: Digital certificates lie at the heart of security where effective security culture enables digital certificates to be widely and properly deployed in organizations. Digital certificates provide a way to secure websites and bank transactions, digitally sign documents and emails, enable secure access to remote locations on the internet through VPNs by providing a means for authentication, authorization, confidentiality, integrity, and non-repudiation. In this thesis, the barriers to an effective digital certificate security culture and the possibilities of misuse or misconception of certificates on both client and server side are investigated by first testing 49 scenarios for misuse and three for misconceptions in the network laboratory in Linnaeus University and, then by conducting a survey designed based on the eight dimensions of the Security Culture Framework. Possibilities for misuse were discovered and described in a Functional Scope Model and the most common barriers were found to be lack of funding and awareness regarding digital certificates within organizations. Overall, it was found that there is high usage, willingness and motivation in regards to certificates in organizations in Sweden but the quality of the digital certificate security culture needs to be improved.