The security industry has an accountability crisis. It’s time to talk about it, then fix it. Whenever a massive cyber attack occurs inevitably a chorus of voices rises to blame the victims.  WannaCry on 5/12 and Petya on 6/27 yet again kicked off the familiar refrains of:

“If users didn’t click on stuff they shouldn’t….”

“If they patched they wouldn’t be down….”

“This is what happens when security isn’t a priority….”

“Now maybe someone will care about security…”

I have yet to meet a single user that clicked a malicious link intentionally – beyond security researchers and malware analysts that is. I have yet to meet anyone that delights in not patching as a badge of honor. There are great reasons not to patch, and terrible reasons not to patch. As always context and situation matter.

…

http://blogs.forrester.com/jeff_pollard/17-06-27-victim_blaming_wont_stop_global_ransomware_attacks