Another key defense is monitoring, and knowing your system.
Where are your valuable secrets, and who has access to them.
If someone tries to connect to your mail server on port 80, red flag.
Why is the mail server, all of a sudden, sending traffic to an unusual IP.
The mail server now has 10x the traffic why?
Monitor people connecting to your external IP's addresses. Drop and/or block all external ports and protocols that are not in use.
No legitimate user is going to connect to your web server on anything but 80 or 443. Unless you have added additional services. You might consider blocking those IP for some time. Sometimes, IP are part of dynamic pools, and you can't always solve a problem with a blacklist, then you just drop the packets.
If your business only does business in 1 country, maybe you should just block all other countries.
You can use whois to find the global owner of the IP address range, and if present use the administrator contact information to notify the owner. They can track it down on their end. (Its worth a try)
You should get notified when any system gets contacted by another system in any unexpected way. After first you may have a ton of notification, but if the computer(s) is on your network then you can investigate both sides. Then either eliminate it or white list it as expected traffic.
These monitor tools will also notify you about port scans, unless you have an authorized security team no one else should be port scanning.
Watch for regular events, and if they stop mysteriously why?
Check the machine for infections. If services are disabled you should be notified in advance so the changes will be expected and not mysterious.
Block as much as possible and monitor the rest.
Now once you have an attack you need to do something about it.
Sometimes turning the system off temporarily is the only option. Maybe you need to block their IP address for awhile.
You still have to protect and monitor all your legitimate services.
In addition to monitoring the community for vulnerability announcements. You should have penetration testers to find the bugs in advance before the hackers. Then you have a chance to mitigate the attack on your terms. Notifying the maintainer of the effect system so they can patch it. If its open source, you can have someone patch it for you.
Intrusion detection systems, and snort can also examine and potentially block incoming hacks by detecting suspicious patterns.
You may have to find an alternate product to replace the vulnerable one depending on the severity of the problem.
As always keeping your software up to date helps to protect you.
This way you can block suspicious activity, until you determine its legit.