Let's say someone has sensitive information on their computer and can is a potential target of 0-day exploits/attacks.
Assuming that they follow conventional security advice (using a firewall, antivirus, encryption, and an updated operating system), are there any other ways to help defend or protect against 0-day exploits and attacks?
Unfortunately, the risk with 0-day attacks is that you don't know what they can do or what they will do. Even if you have an up-to-date operating system, firewall, antivirus, and even full-disk encryption, a fault in any of these could potentially give an attacker access to your system and your data.
With that in mind, discovering 0-days is always a race between the good guys and the bad guys. The bad guys want to find vulnerabilities and exploit them, while the good guys work to patch any suspected vulnerabilities through constant code reviews, audits, and penetration tests.
One argument that could be made is that software released from trusted vendors like Microsoft, Apple, or Google is that, because they have obscene amounts of money to throw at security, their software is much less likely to have vulnerabilities than the average third-party application. And even if a malicious hacker finds a vulnerability in the software, it still takes time to conduct research and develop an exploit that can target computers on a large scale, giving security researchers more time to find and fix the issue.
But ultimately, the fact is that no computer is 100% secure, and Murphy's law holds true. Anything that can go wrong will go wrong.
If this is a matter of secure storage, then there is something to be said about encrypting data and keeping offsite encrypted backups, without an internet connection with which hackers could use to exploit a system and get to the potentially encrypted data. Or there are always type-writers and safes. But conventional software and IT security can only go so far, especially when dealing with the unknown.
Realistically though, the majority of viruses are going to target old, unpatched machines with no firewall. Unless hackers are specifically targeting a victim's machine, it is much more likely that they will go after the thousands if not millions of unpatched and vulnerable computers out there. And if they are directly targeting the victim, there are other ways of getting information out of them: https://xkcd.com/538/
I concur with the comments made about the question being "too broad". I also agree with the statement that when it comes to 0-day exploits we don't have the appropriate countermeasures in place. That is,when we observe the pieces of infrastructure those exploits are targeting in isolation.
However, one could conceive of a case in which even though the exploit delivered does not have signatures/patches yet, the methods of delivery of said exploit or other characteristics of the attack might not be as novel.
This paper on the Cyber Security Kill Chain model is old but gold.
It basically pivots around the idea that intrusion can be modelled in such a way that several (very rough) layers can be defined and elements of X,Y or Z campaign might have been seen in the past (liabilities) and can be leveraged to detect advanced intrusion attempts.
The proposed layers are:
Bear in mind that these layers are not as neat in practice, or organizations might not be able to identify which ones took place or at what stage the intrusion was detected.
The paper makes a "proposal" for countermeasures based on each stage of the intrusion model.
It later goes on to put forth a campaign analysis thought exercise with some useful graphs.
Let me know if I am on the right track at all.
