The real best practices have been the same since the 1970's: know where your data is, who has access to what. read your logs. guard your perimeter. minimise complexity, reduce access to "need only" and segment your networks.  those are the practices and techniques that result in real security. There are loads of fads vying for people's attention but when they come and go, the fundamentals will remain the same."