Building a strong security culture, for many companies, can seem insurmountable. But it doesn’t have to be.