Tip #1 is oh so true, plus...
I usually start our security awareness training sessions by showing them how easy it is to access someone's webcam with a simple google search. That usually catches their attention. Then sprinkle in a few Facebook related security tips, etc. And voila, you have an audience listening to almost every word.
And security training does work. I've had users who before the training would have fallen for a few phishing tactics. Instead they knew how to recognize a fake. If I'm able to prevent at least one person from downloading the latest fake antivirus crap, I've saved our dept at least an hours worth of time & aggravation.
