Companies spend millions of dollars on firewalls, encryption, and secure access devices, and its money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems that contain protected information.