Install launch protection software on every computer on
the network. Launch protection software makes sure that it is not possible to
execute applications or load dynamic link libraries that are not specifically
allowed to execute.
Launch protection makes life
considerably harder for the hacker. In theory he may be able to hack your
network without ever downloading any software to it, but in practice this is
going to be much more difficult.