Don't connect anything critical to any network, directly or indirectly, except a dedicated one separate from the Internet if unavoidable. Never browse the web,

Don't connect anything critical to any network, directly or indirectly, except a dedicated one separate from the Internet if unavoidable. Never browse the web, read e-mail or otherwise run any Internet client from any machine with data on it and instead use a separate machine or if unavoidable a VM on top of a reasonably secure hypervisor to run the browser. Secure every single systems assuming that the network is compromised. Restrict access data to only those who need it. Avoid software written in C/C++ for anything security critical at all costs unless there is no alternative. Only hire competent programmers and sysadmins. Invest in proper physical security.