Focusing on organisational design, businesses can create a security structure that not only protects assets and reduces risk