However , many information security risks cannot be adequately mitigated with technical controls because they are a function of user behavior .
In order to minimize information security risks that are a function of user behavior , users must be trained in information security practices .