Building a cohesive security program starts at the top