Are people the weakest link in cyber security?