Training is not enough: changing information security culture and behaviour
How might we approach reshaping this culture such that people are a source of strength in information security? Security training is necessary but not enough.
Information security strategy: it’s turtles all the way down
Information security strategy, not technology, determines the maturity of an organisation's information security culture and behaviour.