Cybercriminals still allowed to walk into office blocks and convince staff to let them plug in their own thumb drives