A soft approach to management of information security.