Glossing over 10 years of tens of thousands of people's work, things like Titan Rain (1, 2) led to a lot of thinking about monitoring your production environment with things like the istio sidecar system.

(1) https://en.wikipedia.org/wiki/Netwitness

(2) https://en.wikipedia.org/wiki/Shawn_Carpenter

Preventing any unauthorized USB devices or as cards is a basic one. Many defense contractors have USB disabled and/or the ports filled with glue.

Firewall alerts about large outbound data flows.