An alternative to full air-gapping is gateways that pass only the traffic they're supposed to. One example: For many years before they were bought by HP, Comp

An alternative to full air-gapping is gateways that pass only the traffic they're supposed to. One example: For many years before they were bought by HP, Compaq's mail system had a regular Internet-connected SMTP MTA that fed two back-to-back hardwired uucp MTAs that connected to another SMTP MTA that fed their internal network. This was the early days of the public Internet, and they didn't want to have to trust that their SMTP MTA was secure, so they just made sure nothing but mail could ever get through their mail pipeline. It's awkward and a bit of a pain to set up and manage, but enterprise companies have the resources to do things like that. And it did actually provide state-of-the-art email security for its time. (FWIW, I didn't work with Compaq, but compared notes with their network architect on an occasional basis...)