Of course that's always the big question and if you don't have support from upper management then it's not a fight you can win.
With that in mind, and considering that every case is different, what I normally recommend is that you find the highest management who will listen and pile on with the examples of companies which have been sued, prosecuted, or otherwise publicly embarrassed by disclosures of poor security practices.
In some areas, such as those dealing with California customers, or anyone handling medical data, there are actually laws in place which will hit weak security very hard.
Your question is actually outside the strict concerns of how to secure software and is more a question of management but it's nevertheless a question we need to address.
Despite some training in psychology, I've always found it easier to get software to do what I want than people, but you do point out one of the major changes which must take place in the security community over the next decade.
For now I'll only repeat that without management behind you it's hopeless. Once you convince management, perhaps through an aly in the legal department, then you have to get them to give you, or someone, authority to enforce rules and punish violators in some way, perhaps going as far as keeping a list of problems and bringing them up during performance evaluations.
In any case, a clear, written security policy signed by everyone involved and enforced, is the first step to securing software. Without that knowing about specific security procedures isn't much good.
