Firewall Software and Firewall Routers with VPN Endpoint are both a good starting point "because" if someone is pretty good at hacking

and hell bent on getting inside they can and will, especially from countries such as China, Uruguay, Venezuela and alike even Russia have people hackin all day emune from US laws. So my best solution is lock-out IP address groups ie:
24.232.0.0 thru 24.232.255.255,
61.48.0.0 thru 61.48.255.255,
62.62.128.0 thru 62.62.144.255,
80.15.37.0 thru 80.15.37.255 got the idea, if you have problems in a certain area and you don't go there "lock-um out". I kinda have compiled a list from the past 8 years of touchie spots of the world but it can have some limitatons but not many.