Developing Security Climate in Educational Organizations in the Cyber Era

The rapid development of information technology opens the barriers between regions and countries. These developments urge globalization. In educational organizations the involvement of information and communication technology in the world of education is a necessity to improve quality and competitiveness. On the other hand the development of information technology also provides threats including the desire of the parties to take a number of valuable information that is transacted on the internet. This study aims to overcome the problem of information security preventively by developing climate security in information technology-based educational organizations. This study uses a qualitative approach with a grounded theory method. Case organizations are faculty X and faculty Y at university Z. Data collection using interviews. Subjects interviewed were heads of academic fields, heads of information technology units, information technology officers. The results of the study are found manifestation of climate security. In case organizations that develop climate security, caution, accountability, ethical compliance and integrity are found. With these behaviors employees and leaders show an atmosphere of safety at work in the form of an atmosphere of mutual remembrance, compliance not to commit fraud, modeling to work safely, strictness of rules and sanctions, and leadership that prioritizes information safety.

things that cause harm is not limited to individuals who have already prepared themselves. The desire to stay away from this woe also exists in everyone.
An accident is a study of occupational safety and health problems in general. Safety is more associated with physical events because if an accident occurs can cause a physically dangerous situation. Safety is considered an event related to behavior if it is caused by unsafe actions. Research conducted in the field of safety looks for factors that cause high numbers of occupational accidents in high-risk industries. Donald and Young [6] state the chronology of the emergence of safety to overcome the problem of workplace accidents beginning with the broad Human Factors approach. A new approach taken next is to link safety with organizational climate and organizational culture. The new approach was first introduced by Zohar in his publication of the role of safety climate (climate of the organization that prioritizes safety) by Zohar in 1980 as a lighter article [14].
Research on organizational climate is research that captures organizational phenomena, namely the organization's internal environment within a certain period of time [11]. Organizational climate is a kind of perceptual process on individual attributes. Climate in this approach is considered as a summary or conclusions or global perceptions given individually about the organizational environment. Climate safety has more to do with organizational climate.
Organizations devote resources to control threats that interfere with information security. The procedure is to secure a network using a combination of anti-virus soft ware, anti-spyware, firewalls, troublemaker detection, systems for prevention, and software that functions to filter information. Nevertheless the technical security layer succumbs when humans as operators (the last user) become the "weakest chain" in carrying out their duties. Efforts to prevent the occurrence of violations are supported by reasons regarding the importance of person factors and system factors in the occurrence of human error problems [9].
Climate security studies in Indonesia by Ahlan, Lubis, and Lubis [1] find the role of organization as an important factor in overcoming the problem of information security. Psychology like all disciplines is a field that uses paradigms. Behaviorist flow focuses on observable behavior and the way behavior is controlled by external consequences. The known A-B-C model is often used to explain behavioral safety [7]. Bandura shows a phenomenon called "observational learning." Humans often adjust their behavior to see what other people do and based on the consequences experienced [7]. In subsequent developments, observational learning is developed into a process of perception of risk Risk perception is a phenomenon of cognitive psychology that explains behavioral safety.

Methodology
This research is a qualitative study with a grounded theory method. Strauss & Corbin [10] states that grounded theory aims to develop a theory in accordance with the information data obtained to explain the phenomenon under study. "Grounded theory" means as a theory that is obtained inductively from the phenomenon under study. The process of finding the theory begins with systematic data collection, the process of analyzing data according to the phenomenon under study. The process of collecting data, analyzing and finding theories is an interrelated and reciprocal process. The organizations that became the case were Faculty X and Faculty Y at University Z. The data collection process used interviews. The focus of this research is subjective experiences that reveal knowledge, perceptions, attitudes, beliefs, practices about the importance of information security to the head of the field / supervisor / head of the unit in developing climate security.

Respondent data from case X Faculty Y University Organization
Researchers contacted contact persons in faculty X at Z University in Yogyakarta and then got several respondents who held structural positions and also got several respondents in the Information Technology unit who were programmers and administrators as well as unit heads. The researcher gave informed consent to each respondent. In order to get a different context the researcher contacted the contact person at the Y Faculty at Z University in the city of Yogyakarta. Researchers get respondents who occupy structural positions and head of the Information Technology unit. Results of summary data by researcher

a. Case faculty X of Z University Organization
The Faculty X case organization already has a connection on the web. The international network that must be managed by Faculty X is increasingly broad with the establishment of IUP (International Undergraduate Program), so the use of information technology will facilitate cooperation and communication with education abroad. The use of information technology in Faculty X has been applied to all operational processes.
In the beginning, for many years the employees did print test cards, which were then affixed with 1700 photographs each semester. It was felt inefficient. The expertise of the academic head at that time was an electrical engineering graduate. The academic head understands the faculty's business processes, and takes the initiative to pour the manual work into information technology-based. The working principle of information technology after the latest data update, the information can already be accessed. For example, exam cards are printed by students themselves when they have paid tuition fees. Students after KRS can update the latest data. Students who take thesis courses after the latest data update can print a thesis card.
The information technology staff consists of database administrators, programmers, and employees who control the network. Coordination for making applications is carried out by Information Technology unit officers with proposals from academics. Making applications tailored to operational needs. Applications for the needs of each unit can meet the needs of the faculty, so it does not depend on the university. Access through the intranet functions to communicate with other universities and faculties. Access to the university network is using your own internet network. The Faculty already has its own server with band width controlled and modified by itself.

b. Case faculty Y of Z University organization
Early development of the Information system at faculty Y thanks to the acting of the academic head. Initially respondents Z working in the faculty of economics gained a lot of experience and knowledge about information technology. When respondent Z became the head of academic around 1996, faculty Y had information technology that was still simple, but was the most advanced compared to other faculties.
Respondent Z was moved into position in faculty Y in 2010. At first the work process was simple and not safe. The Study Plan Cards were still being collected in the computer room and had to be guarded by academic staff. Presence printed by the hard drive then sent to teaching, the next administrative process is still very simple and manual. Respondents find it inefficient to work. Submission of proposals to make changes is supported by superiors. Initially the manager bought a server.
Next, recruit programmers, and create an integrated IT system between academics, human resources, finance, and libraries. The system can be accessed by students, especially employees, and lecturers. Since then the head of academic and team has been working hard to produce an integrated information system. The unit conveys program content to be designed as needed. Material sent in the form of e-mails to programmers is then interpreted. The proposed material is realized in the program. On Thursday you will check with the programmer. The program that has been formed requires an operator, then a cadre is sought who will be tasked with maintaining the integrated system. The system integrates operational tasks in the academic field with human resources and finance and libraries.
Respondents feel there is a risk if the value information is released without permission. Such violations can be subject to civil or criminal conduct and are a matter of ethics, and morals. Respondents stated that so far in Faculty Y there has never been identity theft to change grades.

The dynamics of the climate security development process at faculty X of Z University
The climate security development process was initiated by the leader. As stated by the following respondents: "Yes, ma'am, actually at that time eee ... so eee um at that time, it was not important to consider IT, ma, still next to it, it was still trivial, after all there was excel, for example, for example, for letters there was still a word, well, not yet there is integration of various kinds, then the name of which is say financial pyramid is counting, you payday there is still typed it still typed it "(W SG2 10-14) "Yes, that was not the incident, in the era of Mr. Ainun, maybe the mother knew Ainun Na'im, that was a figure who was not yet symptomatic at that time, ma'am, initially asked how many of your students were, with the people from Dikti or what, confused from the time that's the dean, at that time the finance was not like now mom, the meeting was not, at that time finance was still managed by all faculties, so there was no RKAT fund hatching, I didn't know anyway, but our side was I was called at that time then asked to make team may you recruit whatever your needs, you are sufficient, well actually from there ma'am, so I recruit programmers, recruit macem-mac ma "(W SG1 90-98) Based on the description of respondents above found the theme of transformational leadership. In information technology-based organizations need leaders with transformational leadership style. Transformational leadership is a person who continues to think for change and visionary, and strive to make changes. The categories found in the theme of transformational leadership in holding information technology systems are expansion, efficiency, demands for change, risk-prone, and autonomous. Besides the transformational leadership theme, other elements are needed in developing climate security.
"Yes, then if I am at home in a non-office we use WA grub, then if on the letter in parentheses we can WA because of security factors and so on using this application, bro, yes use this synthesis you know, bro, fill in the documentsdocuments that cannot be WA, ma'am, may not be shared "(W SG1 237-241) "In the past, it was usually the case that every Monday we had a meeting, coordination between departments in the faculty, so usually when we were there what was the name, what was the security problem we got the info oo usually in the info, well then what do we call it? there is input from superiors, for example, if the nature of the information system is held an audit, but if the technical nature is directly handled by us, usually we have received information from the students concerned, yes we have fixed the system right away, what are the terms in terms of the application we add, what do we add? the name of the programming technical security is like that "(WW 22-30) Based on the statement above, it is found that the section chief has an important role in instilling perceptions about risk in his team. The performance of the superintendent in preventing risk is shown in the managerial practices theme. In the category based on the statement of the respondents found various activities of the head of the department that ensures safety systems, control based, continuous development, collaboration and sharing. Other elements in the climate security development process are found in the following statement: In the above respondent statement found the theme of direct supervisor practices. Activities of direct supervisors such as unit heads are found in the process of instilling perceptions of risk accurately in employees. The categories found were sustainable development, coordination, socialization, regulation, evaluation, informal approach, soft approach, emotional coping. In the above statement of respondents found the theme of perception of risk. On this theme the accuracy of individual perceptions of respondents is described. It was found in the category of administration vulnerable to fraud, human error, workload, weak control. included or what is already owned by Panjenengan? Yes, it's automatically called cooperation, he wants to be able to do it, but there is an agreement, so for example, maybe you represent me, you use my data, well, but there must be an agreement, a confidential data that you have to hold, like that, so the principle is the same as an earlier ee SSL, yes, the eee vendor already has an agreement to secure and so on the external and internal he is like that ..... "(W KMN B 54-62) "If the academic field is the most vulnerable, only the other grades are not simultaneous. Specifically for our grades, there are only two people, two of them are Mr. Wardi and Pak Sigit as his head, so two people, the others are like scheduling menus, opo menus. ee awareness, then lecture services, it is all handed over to the academic section, although later A only takes care of this, B only takes care of it, but when A is not in or is in a meeting outside and the process must be carried out, usually there is something else that can replace his role "(W KMN1 175-181) Based on the above statement of respondents found the theme of accountability. It shows that the process of developing climate security requires behavioral categories that require full responsibility for the task. The categories found are procedure control, control by SOP, control through quality parameters.
"Yes, it is protected, that you are a FEB and you must help to process this student, that is the first, the second is clear earlier, routinely change the password ..... " (W WD 226-228 ) "Oh yes ma'am, so that's ee, I forget what the case is, but there is, so the handyman feels he gives a value of B, but how come it can be A, well, we got this noisy, the effect is to accuse people, and this is dangerous, well then the solution is we just set one person, the entry ma'am, the menu is on that one person, the second we have history bu, they should log in right ma'am ..... what's the password, now the input was seen in the history, who? What time is it? Now we have it now, so once there is a complication value, for example B / A becomes B, we can check now "(W SG1 50-56). "Eee the laptop computer is its own, the password in the value section has its own password? Yes, sometimes the password is sometimes not the computer's password Yes anyone if you want to try to enter it through what should pass the application password access. Yes through the application password first ..... Yes, this is the encryption ..... "(W WR 765-771) Based on the above statement of respondents found the theme of compliance behavior. In the process of developing climate security, compliance behavior is needed. The categories found are control, supervision, authority.
The conclusions of the themes from various descriptions of the climate security development process at X Faculty of Z University are the themes of transformational leadership, compliance behavior, accountability, managerial practices, integrity, ethical sensitivity, direct supervisor practices, and perceptions of risk. agreement, so for example, maybe you represent me, you use my data, well, but there must be an agreement, a confidential data that you have to hold, like that, so the principle is the same as an earlier ee SSL, yes, the eee vendor already has an agreement to secure and so on the external and internal he is like that ... "(W KMN B 54-62) "If the academic field is the most vulnerable, only the other grades are not simultaneous. Specifically for our grades, there are only two people, two of them are Mr. Wardi and Pak Sigit as his head, so two people, the others are like scheduling menus, opo menus. ee awareness, then lecture services, it is all handed over to the academic section, although later A only takes care of this, B only takes care of it, but when A is not in or is in a meeting outside and the process must be carried out, usually there is something else that can replace his role "(W KMN1 175-181) Based on the above statement of respondents found the theme of accountability. It shows that the process of developing climate security requires behavioral categories that require full responsibility for the task. The categories found are procedure control, control by SOP, control through quality parameters.
"Yes, it is protected, that you are a FEB and you must help to process this student, that is the first, the second is clear earlier, routinely change the password ....." (W WD 226-228 ) "Oh yes ma'am, so that's ee, I forget what the case is, but there is, so the handyman feels he gives a value of B, but how come it can be A, well, we got this noisy, the effect is to accuse people, and this is dangerous, well then the solution is we just set one person, the entry ma'am, the menu is on that one person, the second we have history bu, they should log in right ma'am ... what's the password, now the input was seen in the history, who? What time is it? Now we have it now, so once there is a complication value, for example B / A becomes B, we can check now "(W SG1 50-56). "Eee the laptop computer is its own, the password in the value section has its own password? Yes, sometimes the password is sometimes not the computer's password Yes anyone if you want to try to enter it through what should pass the application password access. Yes through the application password first ..... Yes, this is the encryption ..... "(W WR 765-771) Based on the above statement of respondents found the theme of compliance behavior. In the process of developing climate security, compliance behavior is needed. The categories found are control, supervision, authority. The conclusions of the themes from various descriptions of the climate security development process at X Faculty of Z University are the themes of transformational leadership, compliance behavior, accountability, managerial practices, integrity, ethical sensitivity, direct supervisor practices, and perceptions of risk. The process of developing climate security begins with a manual work system with simple technology that causes many complaints. Initially the reason for making changes is the demand for changes found as a category. This was stated by the following respondents: 10 "It's very straightforward, oh, KRS is still collected in the computer room and we have to take care of it, then the presence of the hard drive then we send it to the teaching there, right, mom, and also a lot of ee, it's still very, very simple, mom" ( WZ, [31][32][33][34] Various complaints that arise are complaints about how to work inefficiently, but also risky and inconsistent results. The category found is a demand for change. This is in accordance with the statements expressed by the following respondents: The questions are still collected in the computer room and must be guarded we have to do that, then the presence that prints this hard drive then we send it to teaching there, isn't that right, then also a lot of ee yeah still very, very simple "(W AR 31-34) .
"Ooo, if that time was clear the difficulty was quite large. Older than ever and also inconsistent "(W Z 241-255) "..... then we will one day eee sowan then sir we are still here what if for example IT is included here but with enough cost, the cost is big enough I say so, try pak Zaenal to make a proposal, then I make a proposal, make a proposal for the programmer alone at that time was considered 70 million in late 2010, I entered October that I entered December, Alhamdulillah approved and immediately bought a server .. (WZ 37-43). "Yeah, so the ladies and gentlemen of the dean always provide special eee space for ee SDM to develop, so they always open ee what is the name ee open up opportunities and provide ee support so that eee SDM ee develops her career so that we are always at supported and supported "(W AR 535-539) The approach to subordinates carried out by the leader in the form of firmness towards the implementation of the procedure. The category found is control by procedure. This assertiveness is revealed in the following respondents' statements: "Eee, ee. We always give data, there must be an agreement from KASI Academic, so if we do not cause that problem, we always ask what is the approval from KASI (W AR 527-529). "Yes, so if we provide a student data that we do not know, is he a relative or whoever he is, if he comes to IT, he must have a letter that is authorized by Mr. Zaenal" (W AR 352-354).
The leader filters information leaks through procedures for accessing data. The category found was control by procedure. This was stated by respondents: Yes, so every user or every student has his or her own account integrated with student NIU, with different student NIUs, we give their ee access rights according to their own data, so the leaks are already filtered at the start (W AR 382-386) The leader has an advanced vision and seeks to make changes. The leader strives to make changes and has clear goals for change. The theme found was that organizations that use information technology need leadership with transformational leadership style. Leaders feel the weakness of protecting information because of the tendency of lecturers to give trust to subordinates. This was stated by respondents: "So actually the one who is more likely to have the right is the lecturer, but here it is undeniable that the lecturer is more likely to submit the task of inputting the system to the academic admin section, more precisely the admin is to input values, plus another one namely the head of the academic KASI ee has all the menus in the information and integration system "(W AR 182-187).
Besides the role of leaders with transformational leadership styles in developing climate security, other elements are still needed. Respondents in case organizations feel doubts about their ability to overcome risks. The found theme is risk perception. which is less accurate to the risks faced. This shows the respondents felt the inaccuracy in perceiving risk.
Aside from integrity in the process of developing climate security, support from superiors is still needed, as stated by respondents: To see confidential information, you must report it to your supervisor (W AR 333-342), superiors deliver SOPs to subordinates but are less aware after there are facts and new incidents individuals understand (W Z 204-222) and there is a need for assistance (W AR 407-419) Based on the respondent's statement it was found that there were still low categories of monitoring, authorization, safety system, coaching, and awareness.

Figure 2.
The process of developing climate security with the type of "knowing"

Discussion
The dynamics in the process of developing climate security in the case of the Y faculty of Z University called the "knowing" type are as follows. In information technology based organizations needed leaders who apply transformational leadership style. The leader together with other leaders lay the foundation of the importance of controlling risk. However, it was found that the awareness of members of the organization was still low on risk. The various themes and categories found in the process of developing climate security above can be interpreted as a process of type "knowing". The meaning of "knowing" is individuals knowing and realizing risk but the desire to manage risk is still very limited. That is because the atmosphere that develops in the organization psychologically does not yet have the same perception of the risks faced. The approach taken is both regulatory, informal, and has not yet fully raised awareness of risk as a preventive measure. In this organization the assertiveness of the leadership role is still needed so that employees and all elements have an accurate perception of risk. The process can be done through regulation, coaching, training and approaches formally and informally. Even so there has not been found any high awareness among employees and all elements of the organization.
The dynamics of climate security development process with the type of "readiness" was found in the X faculty of Z University. The readiness type indicates that the process of developing climate security has been pursued but is not yet urgent as a necessity. Starting with a leader who has transformational leadership style is needed to make changes. His views on progress and his hard work to ensure change is truly realized are urgently needed. The leader, together with managerial, and supervisors instill an accurate perception of risk in employees. The managerial leader carries out risk socialization. The leader chooses employees with honest characteristics and integrity to occupy critical positions. The leader emphasized the importance of a comfortable atmosphere at work, and mutual support for each other. Family conditions become a means for leaders to approach employees.
The results of the study are the manifestation of climate security is vigilance, accountability, sensitivity to ethics, and integrity. Various processes to instill appropriate perceptions about risks are carried out starting from mentoring, socialization and unit meetings. The head of the information technology unit instills ethics at work and self-integrity at work. Exemplary shown by the head of the academic so as not easily influenced by persuasion to commit fraud. The academic head collaborates with the head of the information technology unit for data sharing and data base creation. The process of  13 developing climate security in this case organization is supported by facilities and the presence of an information technology unit (SIFE). Nevertheless awareness about risk was found to be still limited to leaders and information technology officers.
The process of organizational climate evolution is a process of organizational construction in reality. This process can only be seen from a psychological perspective. The mechanism that takes place in the evolutionary process of a climate is a dynamic social process. The mechanism of the evolutionary process of climate change requires explanation from a sociological or organizational perspective analyzed at the organizational level. The process of evolution produces an organizational climate.
In the era of non-technological organizations there are five factors that influence organizational climate. These factors include setting goals, opportunities to carry out initiatives, working with highly competitive and competent superiors. In the era of information technology the organizational climate dimension will change because it involves the role of information technology. The dimensions of the organization's climate will include the required work behavior, the personal characteristics required, and the required social environmental characteristics. Required work behaviors, for example, vigilance, systematic work. Personal characteristics that are demanded for example responsibility, and honesty. Characteristics of the social environment include strict control through procedures and person. The social context in information technology-based organizations contains social processes that are colored by the presence of information technology. Changes in social context will cause the emergence of new values.