Put simply: if the network can talk to the public facing Internet, it’s vulnerable. You can solve this with airgaps but even those are vulnerable to side chann

Put simply: if the network can talk to the public facing Internet, it’s vulnerable. You can solve this with airgaps but even those are vulnerable to side channel attacks. One thing you could do is remove any ‘radios’ from the machine that can be used for exfiltration and thoroughly vet and audit all your hardware. Bonus points for placing the machine in a giant Faraday cage.