Any government agency’s first line of defense against cyber risks is its employees. However, they can also be the weakest security link.