fatman

UK

Couch potato

Users generally don't care about security because they don't understand it and moreover, because the data being protected is not personal to them.

Ask 100 people in the street for their credit/debit card number and PIN number and 99 people will tell you to get lost. It's personal - the risks are obvious - they could lose cash from their bank account.

Therefore, the challenge is to raise the issue of security within the business so that they feel personally responsible for it within their area of the business.

Doing this includes, having a corporate security policy and enforcing it, firing employees who continually flout established policies, offering rewards to those who report suspected or actual breaches of policy, making an example of individuals who flout policies etc. Security policy and responsibility for security should be included in every employees contract of employment.

Kind of a 'carrot and stick' approach overall.