Here is Moyer's list of internal controls. The correct firewall infrastructure is crucial to a secure perimeter architecture. The organization's information security group, or internal audit team, needs a way to independently verify the integrity of every file on production systems. Those that collect system logs frequently roll them over without reading or archiving them. There are many cases where a system log can alert the administrator that something is amiss.
Fewer attackers can quickly and completely cover their tracks than can break into a web server.
There are a number of good commercial intrusion detection systems, such as the ISS RealSecure system. If the organization is not comfortable monitoring their own intrusion detection systems, they can hire an outside team to build and monitor their intrusion detection systems. Minimize the number of people who have access to the perimeter systems. From experience, controlling system integrity on a machine with three users is more than an order of magnitude easier than on a system with thirty users. Log access to the systems, and review the logs.