Be suspicious of changes in usage or types of traffic. Enable detection of unsolicited ICMP echo replies and unusually high traffic levels. Use network intrusion detection. Systems, too, require a set of prevention procedures. This is especially important when the patches fix known security vulnerabilities.
Examine system logs periodically.
Look for evidence of intrusions and take action based upon your response plans. Use cryptographic checksum tools. Periodically compare systems with your reference system, using binary integrity checking tools, such as Tripwire. Implement a host security certification process. Make this part of the deployment and ongoing maintenance of any systems you have exposed to the Internet.