Identifying Differences between Security and other IT Professionals: a Qualitative Analysis.

Abstract We report factors dierentiating,security and other IT responsibilities. Our,ndings are based on a qualitative analysis of data from 27 interviews across 11 distinct organizations. The re- sults show that compared to general IT, security professionals have to manage a higher level of complexity, stemming from factors such as the need to balance usability and security, negative stakeholder perception, and external threats. We synthesize the dierences into an overall model and discuss how the model can guide the development of support for professionals with security responsibilities. Keywords Security Administration, Qualitative Analysis, Information Security Culture