Are we talking about some specific systems or just generic techniques?

If generic - you've got some good answeres already. I would add - segment your networking. Assume every system will be owned, sooner or later - and plan for it. Local firewall is nice, but when (not if) someone will get "root/Ad...

[ more ]