We employ network Intrusion Detection Systems as well as IDS on each individual host.

Each users' individual filesystem is in a chroot that isolates it from the rest of the system.

Finally, user filesystems all live on data partitions that are mounted noexec / nosuid / nodev which provides an additional level of safety against sophisticated attacks.