Book excerpt: Angus McIlwraith's book explains how corporate culture affects perceptions of risk and information security, and how this in turn affects employee behaviour. He then provides a very pragmatic solution involving strategies and techniques for educating and training employees in information security and explains how different metrics can be used to assess awareness and behaviour.