I understand that a lot of people think and feel that way. The change has to be at a society level. The standards of what people need to know and do needs to be set by society. Remember, the real issue is not home users. Enterprise security is atrocious because most admins just "try to get things to work" and when it does, they leave it at that.
IT security is a world problem, a societal problem - and not merely an individual problem. If IT security is left always to the individual and the corporation, then nothing is ever going to change. The laws across the world and the expectations that you can't hold people accountable at a bare minimum level is another obsolete mode of thinking about users.
Everything is connected via the internet. So the collective is responsible. Everything cannot stay the same like the Wild Wild West where everybody just does whatever "to their own ability." Huge sums of money are involved here. And believe it or not, ultimately those financial losses are being transmitted to consumers and tax payers.
It is a difficult issue. But until the way of solving it changes, nothing will change. The answer is not merely installing AV. It takes a lot more than that.
I hate to say this, but anyone who is younger than age 30 should be fully IT security literate at a basic level - across the entire world. Now it is govts and society (to include industry) that need to make that happen. And as time goes on, and younger people who are more comfortable with IT security increase as a percentage of the world population, the world will come out of the IT Security Dark Ages.
There is no reason why children cannot be taught
guide to IT security (local host and router hardening). It's not that difficult. Something that most any grade and high school student can learn in a couple of weeks. It is like a 1 or 2 week project. Then after the student just needs to keep doing it over and over. It's more important for them to learn than spending countless hours gaming or wasting time on a million other non-important things in life.
Just wait until one day some ATP group cripples for months a national social welfare or other distributed system and the govt cannot issue benefits, or pay its bill, or damages the electric grid so badly that the electricity is off for months. Can't happen. Oh, it has already happened. It might have been on a limited scale so far, but it is just a matter of time before defenders make serious mistakes in protecting their digital assets and some malc0de group comes along and smashes a society. Society should be afraid. Very afraid.
