If the employee can be your strongest link, as opposed to the weakest, then it is imperative that security policies and best practices are driven to the company, and that the company is on board with them. We talk to Tracey Dedrick from ISACA about this consistent issue.