The proper solution is a hardened machine build for critical systems that doesn't have internet access, disabled USB, attachments blocked in email, etc. Howeve

The proper solution is a hardened machine build for critical systems that doesn't have internet access, disabled USB, attachments blocked in email, etc. However that isn't popular and most orgs would prefer a day of downtime from this type of outage vs the hassle and cost of doing it right.