Just restrict network access (both in and out) with proper (trusted) hardware firewall. It's much safer that relying on disabling / configuring etc. You can't attack what you can't reach (directly or in reverse).