Too many people in the health and safety professions cannot conceive why someone might send them a malicious e-mail or try to crack their password, but an attacker only needs to find one weak link in order to penetrate your network. Leaders must mandate security on the network. Develop a security policy that specifically identifies the value of the information on your network. Now decide what steps the department is willing to take to protect it. Then develop and implement security measures on the network that reflect this policy.
Security only works if the secure way also happens to be the easy way.
If security measures obstruct the operational processes of your department, your users may ignore them because they have jobs to do. The result could be an actual diminishment of security after you implemented more stringent policies. Therefore, make sure your department's policy is reasonable, and strikes a balance between security and productivity. Look for ways to make the security processes have value to the users. In cases where you must impose restrictive security measures, then deliberately explain the reasons why they are necessary.