Unless people have some training or background, thy will proceed blindly along until something actually Makes them pay attention.
Start with such basics in high-school, or even earlier than that. Explain (and mark their understanding) of things like strong vs weak passwords, and simple security procedures. E-mail safety tips. Good file management practices. Even basics like how to take care of a keyboard and/or pointing device would go fairly well in such a course.
Oh. Almost forgot: MAKE IT MANDATORY! Nobody gets to use the school computers/labs (even Office Staff) if they don't show proficiency. No personal systems should be allowed access to the school network without a valid certificate either, lest they infect the whole thing from their own carrier box. Ban those who violate the practices and cause problems. Make them responsible for what they caused, and Sit Through the repair procedures with a technician as an additional education in what happens, and what has to be done to Fix things, or no forgiveness, and therefore, no regained access! Give them a sense of what they are avoiding, and even what to do to fix a problem on their own system, should they get afflicted at home.
Start 'em young, and train them in the ways of the system. The results will be worth the effort.
Seriously: If people don't show they are responsible enough to use the school (or company) systems, they have no business accessing them, and probably shouldn't be working there in any capacity.