In the end, what is left and what could be done as an emergency measure? I’m afraid there’s not much that can be done to approach 100% efficiency.
Probably one of the most promising security measures would be traffic shaping IDSes and communication between different ones. They still need a lot of improvement to prevent false positives, because false positives tend to bore administrators who then end up not listening to alerts anymore.
Full disclosure of vulnerabilities is surely a way of facilitating the task of exploit writing. On the other hand, imposing a total blackout on vulnerability discovery and disclosing it only to the vendor (or publisher) of a piece of software is surely a way of; 1- not inciting hackers to discover holes, and 2-having some hackers keep them for their group of friends to carry out their own exploits.
Good old solution: patch, patch, patch
Last word: patching a system as soon as a solution has been found to a security vulnerability has always been the best solution to avoid security problems.
More info: http[url=http://www.net-security.org/dl/articles/wf.pdf]://www.net-security.org/dl/articles/wf.pdf[/url]