The combination of ipchains (tutorial here) and a hardware firewall router (like the Dlink DI-704P or the Linksys BEFSR41) is just about the best way to secure an internal network. On windows-based pcs, getting something like ZoneAlarm or BlackIce Defender should be an early start for securing those pcs on the network.
Know that the security of any program or machine is only as good as the person who set it up.
