Comment Good backups and minimal access elevation (Score 1) 219
The best thing you can do is plan to mitigate any damage done. Of course this is easiest by not giving anyone any rights at all, but when you do have to give someone any kind of power try to wall them in as much as possible, so what damage they can do is very limited. Offsite backups that they dont have access to is best for recovery, especially if they have physical access to the site. I know some people will complain that treating everyone like a criminal will encourage destructive behaviour, but at the same time using smart/sane security precautions shouldnt scare away any reasonable people, and those who do react badly to being walled in probably arent the people you want on your site to begin with...