Data security scholar Eugene Spafford argues that the subject needs to be taken more seriously at the highest levels of companies.