Training is not enough: changing information security culture and behaviour

How might we approach reshaping this culture such that people are a source of strength in information security? Security training is necessary but not enough.