I think "good security/engineering practices" still has a chance.

Things like--

  * Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum 
  * Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
  * Encrypting data at rest

All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.