I've noticed increased frequency of ransomware questions around Stack Exchange. Some of the people I remotely know had their devices recently infected as well.

I'm starting to be concerned. When people ask me how to avoid viruses, I typically tell them things like not to download files from suspicious websites and attachments other than documents. But is it really correct of me to assume that people who become infected executed suspicious files on their computer?

This concern raises especially now when I see questions from people who became infected here on Stack Exchange - meaning technically aware people are obviously just as vulnerable.

How does the ransomware possibly get on their computers? What's a good way to prevent this from happening?

According to the IBM X-Force Threat Intelligence Quarterly Report, fourth quarter 2015, the primary sources of ransomware attack are unpatched vulnerabilities, drive-by infections, and spear-phishing emails:

Source: IBM X-Force
How to prevent ransomware attacks
User education
Educate your users not to download files from unknown contacts. Usually ransomware is sent in emails claiming pending invoices with Word documents. When you open the document, ransomware will get installed and start doing its job.
Scanning and filtering mail servers
Scan your mail servers to stop phishing attempts reaching intended recipients.
Backup data regularly
Make sure to back up your critical data regularly and secure them. This will help you avoid paying the ransom, and reduce recovery time.
Vulnerability? Patch critical software and OS right away
Patch your critical software like your browser, browser plugins, email clients and operating systems right after you get a notification. Did you know that the Panama Papers leak (2.6 TB of data) happened because of vulnerable web servers and mail servers?
Look at the ransomware growth in the last three years:

Source: McAfee Labs, 2015.
