When senior managers don't follow information-security policies, they set a dangerous and destructive tone.
