IT security awareness training: do it now