http://it.toolbox.com/blogs/itmanagement/addressing-the-security-elephant-in-the-room-selling-security-76448