If they have such hacking attempts, console access should be gated by a jumpbox that SSH/ipsec secured by SPA portknocking. For external services, have transparent proxies with deep SPI/IPS and IP acls out in front.