It sounds like you may be a person outside of IT attempting to educate your peers. While this is a good thing and something I would encourage, your IT department should be driving the security standards and policies.
This training should serve as a means to re-enforce and educate on the reasons behind the security policies already in place. If there is not a written security policy document, there should be.
Many of the things you list should not be within the end-users control. For example, the average less technical end-user should not be able to install software on their workstation. I suspect there are numerous support, configuration, and malware issues within the company that could easily be prevented by policy if they can.
If the fundamentals are not already written and enforced by IT policy, these are issues that should be addressed before attempting to educate the users. Some of the end-user focused policies include:
- Least privileges necessary to perform job function
- Software updates automatically performed with attention to security risk
- Security standards enforced by policy (IE. Web browser settings)
- Password expiration (90-days)
- Password strength enforcement (Alphanumeric, mixed case, 9+ characters, et cetera)
- Unable to use last 5 passwords
- Portable device (laptop) storage encryption
- Data classification policy
- Policy dictating handling restricted and confidential data as defined within classification policy.
- Data disposal policy
- Data access policy
- Portable device policy
There are a myriad of additional policies and procedures that apply to both proper development and technical maintenance within the infrastructure groups. (Change control, code review, system standards, and much more.)
After all the foundation is in place, employees should be provided copies of the written security policy and training surrounding that policy would also be appropriate. This would cover end-user best practices both enforced technically and not. Some of these include:
- Handling of restricted and confidential information as part of business.
- Don't e-Mail or transmit unencrypted, dispose of properly, et cetera.
- Handling of passwords.
- Don't leave written under keyboard, on post it notes, share, et cetera.
- Don't share accounts or authentication data. (Again)
- Don't leave workstations unlocked or company property (data) unsecured (laptops)
- Don't run software without consideration
- Such as e-Mail attachments.
- Risks and scenarios surrounding social engineering
- Current malware trends applicable to the business or industry.
- Policies and risks specific to the business or industry.
- General education regarding how (if) they are monitored
- How IT enforces the security policies technically and administratively.
The PCI DSS examples many best-practices concerning security policies. Additionally, the book the Practice of Systems and Network Administration covers fundamental best practices regarding IT security.