Security expert: To prevent breaches, which is more important: process, technology or people? Without process, there is no right way to implement technology, he says. Without governance, without governance your security program is an accident. Without defining how technology is maintained, some administrators might securely configure the technology under their charge, some won’t. A good awareness program tells people what they should be doing, not what they’re worried about, says expert. Awareness programs should focus on informing people about the behaviors specified within the governance documents, not random best practices.”]