Security is a cultural as much as technological challenge. Culture is defined as shared values and behaviors that create everyday organizational reality. No policy or technology can overcome weak security culture. This session will provide an empirically grounded model for creating cultural firewalls, measurable infrastructures that improve security and reduce risk at the level of human behavior.