2. restrict outbound connections to known malicious IPs or domains.
3. run untrusted code/apps:
- under a different user - or inside a sandbox - or in a VM