Designing a behavioral change program requires an audit of existing security practices and where the sticking points are.
Source: Threadpost