The key part about technology is that it evolves.
Sure you may apply the best practices, such as:
- Keeping up to date on vulnerabilities
- Ensuring software and OSes are up to date
- Checking logs for potential intruders/problems
Depending on your environment, you may also want to be proactive. This would include:
- NIDS and HIDS (Network/Host Intrusion Detection Systems)
- Stateful packet inspection with a UTM or "Next-gen firewall"
- Advanced, multi-level, on/off site back ups using a GFS scheme (Grandfather, Father, Son).
Information security is about Risk Assessment, which draws a similar approach from that of business, economics, and many other fields. Zero day vulnerabilities, and the attacks that use them can not be prevented by following best practices. This should always be factored into a risk assessment, as well as other topics. To a small corporation, zero-day attacks might be too expensive to plan for and defend against. There is simply the lack of staff, equipment, or the capital (cash) to do so.
The key part to remember is that best practices should be a baseline, and by no means complete. However, there are situations that call for that to be the "good enough". As highlighted before, a SoHo (Small Office/Home Office) environment wouldn't have the resources to implement a hardware based stateful firewall. Certainly the environment should have some simple form of backups and anti-virus but should there be a plan for data loss due to a fire, earthquake, or other serious event? What about the loss of the external hard drive that contains weekly backups? Should a plan be in place for theft of the machine itself? Is there sensitive data on the machine?
There are plenty of questions that will need to be answered, and only when these get asked and potentially answered, will there be a clear understanding of whether applying security and usability best practices aren't enough.