Machine separation for one (OS level exploits, escalation of privileges in one component compromising another). Network partitioning with strong protocol filters between security tiers can be invaluable.