Even firewalls are just a last resort defense IMO. The primary thing is not having any crap listening on ports in the first place.