It begins by explaining why people are as much a concern as the more traditional, technological security topics. Personnel policies and practices related to computer security are then explored from several perspectives: avoiding problems, building attitudes, contributing to a supportive environment, and shaping people's behavior. Recognizing that the security officer often is unable to influence personnel policies and practices directly, suggestions are given for indirect influence through liaison with upper management and personnel department staff. (Publisher abstract)