Everything that Matthew said plus the ability to easily reload from a cryptographically good backup copy of the OS if it detects anything has gone awry without

Everything that Matthew said plus the ability to easily reload from a cryptographically good backup copy of the OS if it detects anything has gone awry without disturbing your "applications". I'd highly suggest following the link he gave, it is a very interesting revue of many modern and practical security approaches.