Ones I've actually witnessed in previous jobs rather than simply hearing of are: attempt to disable connection of USB thumb drives, restrict external website ac

Ones I've actually witnessed in previous jobs rather than simply hearing of are: attempt to disable connection of USB thumb drives, restrict external website access, apply outbound email monitoring, keep important data on VMs + disable the clipboard. The common theme was that they generally inconvenienced, as all had fairly obvious ways one might hypothetically evade them. The sorts of steps LinuxBender suggests seem more sensible at a cost of being more invasive, it's just a matter of much the company is willing to go before it is impractical. Locking down the BIOS, encrypting the hard drive and isolating the computer in a secure room are the other points I'd expect, but that takes things to different level and it's less about regular employee situations then (so maybe getting off topic?)