It can be a cloud service using an agent application and different authentication than the network.
It can be a specialized appliance that is not accessible to the loads by normal means.
Hell - it can even be *tapes* you physically remove.
Firebreak that shiz.
2/2