Follow known best practices and apply software patches as soon as they are announced by your incident response team or your vendor. An unneeded service can become an avenue of attack. Disallow all remote administration unless it is done using a one-time password or an encrypted link. Limit the number of persons having administrator or root level access. Log all user activity and maintain those logs either in an encrypted form on the web server or store them on a separate machine on your Intranet.
Monitor system logs regularly for any suspicious activity.
When the macros detect a change, they should send an e-mail to the system manager. Apply all relevant security patches as soon as they are announced. If you must use a GUI interface at the console, remove the commands that automatically start the window manager from the .RC startup directories and then create a startup command for the window manager. You can then use the window manager when you need to work on the system, but shut it down when you are done. Do not leave the window manager running for any extended length of time.