I was going to ask about how to educate users, but now that I think about it, I first want to know if it's actually possible to do effectively at all.
Are there any amazing success (or horrible failure) stories floating around about user education, and different approaches thereto? Any statistics on whether companies that attempt to educate their user base about computer secure are, in fact, less likely to suffer a major compromise?
My own experience is that people are often unwilling to alter their usage habits - especially more knowledgeable end users, who assume they know enough to avoid compromise. But my experience here is pretty limited, and based mostly on home/desktop use rather than office/workstation. I'm interested in hearing how this stuff plays out on a larger scale.