The weakest link in any security plan or implementation is a human. The weak links include everyone from the hourly paid end user to the owner of the company. Even many of today’s security professionals may not have the time or ability to perform their current duties and keep up with an ever-growing number of threats. If someone is not aware of a threat then they are going to behave as if there were none. The job of the security professional is to change this behavior. It involves using a combination of technology and education to help users understand and follow security requirements. Everyone needs to understand why we need to have security policies and why they need to be followed.