1. restrict outbound connections by binary. 2. restrict outbound connections to known malicious IPs or domains. 3. run untrusted code/apps: - under a diff

1. restrict outbound connections by binary. 2. restrict outbound connections to known malicious IPs or domains. 3. run untrusted code/apps: - under a different user - or inside a sandbox - or in a VM 4. remove exec permissions to temporary directories (/tmp, /var/tmp, /dev/shm)