Managing the human factor in information security : how to win over staff and influence business managers