Many times I hear that big entities such as NASA, Gov places, big enterprises get attacked somehow. So my questions is, if those huge places get hacked, then it could easily be us. I assume those places have great firewall policies, servers etc... Any comments?
Very very vague question. You're assuming that huge organizations are all tight ships...they're not, necessarily. It's far easier to lock down a tiny network.
Plus we don't know what your configuration is, your user education/tech skill is, what you have in place to prevent social engineering, etc.
Each place has it's own culture and way of doing things and their own tolerance for security issues. Some are more lax than others, and there's no one-size-fits-all approach to security. I think your premise may be flawed in reasoning.
EDIT: I would add that for security, most breaches aren't from "hackers". They're disgruntled insiders. Your users are your greatest asset and weakest link. How many problems come from careless disposal of hard drives (check on ebay, run a recovery on the drive...), discs taken, someone's file or email is carelessly forwarded, shares that aren't properly secured and sensitive material is put on them, laptops stolen or misplaced and aren't encrypted...even just plain ticking off an IT worker or other employee with authorization to material who gets angry with their boss or work situation. Or policies are just plain weak and let users play with P2P software that ends up sharing their entire drives.
In the end you have less to worry about China or Russian botnets and more to worry about your employees deciding they've had enough of the crap they get at work or just being careless.
I wouldn't guess at this. Run Nessus against your public IP space and then run it again on the inside. Take the reports it generates and rectify known vulnerabilities by applying service packs, patches, and security updates. This is your job! Management may not see it as important, but just show them the vulnerability report and they'll give you time to get it done.
Or pay someone to do it for you :)
The correct place to discuss this would be over on the newly formed IT Security Stack Exchange.
From my 15 years dealing with exactly this, some points:
As Bart said, large corporates don't typically run a tight ship. They usually do the minimum to meet regulatory requirements, as they don't need to be secure, they just need to mitigate the risk to the required level of acceptance.
Contrary to what Arenstar says, hackers don't care who you are - the tools to scan the entire Internet for vulnerabilities are constantly running. Anything that pops out of this first phase then is passed on to other automated tools which will look to install a shell, bot or warezshare. At this point they still don't care who you are, and I have had to carry out the same incident response and cleanup actions in a global bank and a local hardware shop.
While they are in there, they may well have a poke around, they may not,but you want to put controls in place because if they do find a customer accounts database or something equally juicy they will abuse it, either themselves or by selling the contents to someone else. It's reward for low risk and low effort - of course they will.
The hackers you speak of, are not interested in your ftp/web server or music collection...
IMHO, there are people out there that are way smarter than the people being hired for "security".. and generally we learn from these people too.. ( oddly enough )
They will not care to aimlessly scan the internet for open ports.. Paranoia is a waste of time if we all look at this logically.. :)