An Analysis of Information Security Governance Structures : the Case of Société Générale Bank