Use switching hubs with remote control and possibly even some filtering capabilities.

That way, if a particular machine is causing trouble, you can turn it off. That's particularly effective in combination with network security scans.

Switching hubs also keep crackers from monitoring network traffic once a machine is compromised. If you have filtering, you may be able to enforce (well, strongly encourage) the use of particular network protocols and turn off others when there are specific problems.

You also get better performance with switching hubs, another reason to install them.