We are a development team within a state public university. Much of our development deals with working with private student and employee data. Some applications push data from internal databases out to cloud-based solutions via secure file transfer or web services. New rules are coming down from the state-wide University System which governs us requiring protection between systems that access the Internet and access internal private data. These rules do not define what type of separation is required. The problem is not separation between development, staging, and production (which we already have) but rather protecting development workstations that can access private data from Internet-based attacks.
Other than client-based anti-virus and anti-spam, and network-based firewalls and proxy servers, what are reasonable steps that can be taken to protect development stations, or production servers that need to talk to cloud-based applications, from being a conduit to private data?