We have a handful[1] of secure machines that are allowed to SSH into production systems. No development or other Internet activity takes place on those boxes.

[1] A handful because many of us are remote. Mine is a EeePC.