A positive security culture needs to come from the top down, and involve everyone in the organization