...It seems to me that his co-workers understand the risks better than he does. They know what the real risks are at work, and that they all revolve around not getting the job done. Those risks are real and tangible, and employees feel them all the time. The risks of not following security procedures are much less real. Maybe the employee will get caught, but probably not. And even if he does get caught, the penalties aren't serious.
and it goes on to suggest
"Fire someone who breaks security procedure, quickly and publicly,"
Here is the full article... http://www.guardian.co.uk/technology/2009/aug/05/bruce-schneier-risk-security