Have a Computer security professional scan your network and computers from time to time to know what ports you have opened up to the internet.

Justify why they are open, if there is no business justification for it close them down.

Applications frequently open ports you will not know about and since most windows software wont document some of this you will not know if you do not actively scan these system. Worms can exploit this like SQL Slammer did. Most of the systems that were infected were exposed not because of SQL Server 2000 but because of applications using Microsofts Embedded database software.

Scan yourself, the hackers are and if your not they know more about your systems than you do.