not installing os updates,not keeping anti malware up to date,not locking doors to computer rooms,not logging off or locking computers,writing passwords on sticky notes,sharing passwords,losing memory sticks and mobile devices, not applying wireless network security,not encrypting data, people are not a form of attack