Information security measures are far more effective when supported by top management. How to get this support?