Professor Alan Woodward from the Department of Computer Science at the University of Surrey via The Register:
Educate users not to open files that they are not expecting. Practice your ABCs “Assume nothing, Believe no one, and Check everything should be drummed into users” personally I preach ABCD – if in any doubt Delete.
Incidentally internal simulated phishing is extremely effective in my experience.