Break-ins will happen. List and prioritize everything that must be secured, such as people, technology, facilities and knowledge potentially lost with employee turnover. Write a thorough security policy. Find the technology to implement and enforce the policy. Think about outsourcing some or all security to save money.
Firewalls are a good place to start.
Consider subscribing to intrusion detection monitoring services to monitor networks and respond to attacks in real time. Use established security players. Beware of hardware vendors that have recently relabeled themselves as security experts or intrusion detection firms. Get references, no matter what. If vendors' customers are too security-conscious to talk, have them call you directly.