Given that stuxnet was probably delivered through USB, the only way forward is not going to be prevention but detection by having both automated gaurds and "physical" guards.