What are the areas or technologies to focus on to protect users and devices?
Are patching, antivirus and firewalls still the main areas?
How do you defend against attacks against vulnerabilities that have no patch?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
User education & training is huge. Get the users to help you play good defense.
I always like to see the security programs that award spot bonuses to employees for challenging a person in a secured area without a badge. You can be creative and extend this idea to phishing attacks, pretexting, etc; for example, send out a mock phishing attack and reward employees for calling it out and not falling for it.
Keeping up to date on patches is key - Secunia Personal Software Inspector rocks.
No. Secure coding is the main area. A patching and secure update system is important for feature upgrade, quality, metrics, and security reasons -- it may be a strong requirement for many end-user devices in addition to secure coding.
I avoid using and recommending firewalls and anti-virus agents at all costs. They make you less secure, and not just because they provide a false sense of security. They are accident prone, insecure ruses.
Sim - in addition to the good points Tat and atdre make, there are mitigating controls to defend against zero-days. The main one is a strong security architecture. Please see this question for further answers.
It may be obvious, but another key consideration in mitigating the threat of zero-day vulnerabilities is simply reducing the attack surface area.
Java-based drive-by downloads for instance, aren't a threat if users who don't need the JRE don't have it installed or enabled in their browsers. Eliminating applications, features, and services that users don't need will eliminate attack vectors that malware would otherwise try to take advantage of.
I hope this helps,