Put machines with sensitive data on a private network. Have one machine/one set of machines connected to both the private network and public network that proxy requests to the data machines. Proxy by parsing original request and then rewriting (i.e. don't just pass along the request). Rate limit and implement notifications on data machines so that if the proxies are compromised, the attacker can't easily do a full data dump. Don't allow remote administration only physical (this rules out this architecture for most companies, but honestly, not a company like equifax with incredibly sensitive info and where network locality is not a big issue).