This thesis is based on the viewpoint that no security countermeasure is perfect, each an every one requires some trade-offs to the end user, whether it is limited usability or inconvenience, but as the result of unintelligently implemented security countermeasures errors, carelessness or dissatisfaction among employees may increase internal risk. This thesis is based on theoretical review and one case study. The research question in this thesis is: How information security countermeasures are perceived by employees and how they change their behavior affecting internal threat level. To answer that question, this thesis examines various formal, informal and technological countermeasures from the point of end user knowledge and emotional aspects.