Comment by chrismarlow9

Assume everything is compromised and construct internal architecture accordingly. The best you can ultimately do is try to limit the impact.

Proper firewall, TLS, strong crypto, secrets management, 2FA and regular audits. Zero trust stuff