Companies also shouldn't underestimate the power of publicity, says IT security expert Jim Litchko.

He points to a situation that played out at a government intelligence agency where a senior official, against agency policy, brought in a disk that turned out to contain a virus. The agency fired him and let everyone know it.

"To those people who value their jobs, it's very effective" in highlighting the importance of security, says Litchko, president of Litchko & Associates Inc., an IT consulting firm in Kensington, Md., and past chairman of the IT security council for ASIS International, an organization of security professionals.

Employees should also have simple steps to follow if they suspect security problems. Litchko says one company had stickers on its computers providing information on typical scams, along with a number to call for help.

Integrate Security Awareness