If the employee can be your strongest link, as opposed to the weakest, then it is imperative that security policies and best practises are driven to the company, and that the company is on board with them. We talk to Tracey Dedrick from ISACA about this consistent issue.