While the government and industry are spending money on programs and firewalls, some experts say the real problem is in training the average user.