par·a·noi·a (pr-noi) n.
1. A psychotic disorder characterized by delusions of persecution with or without grandeur, often strenuously defended with apparent logic and reason.
2. Extreme, irrational distrust of others.
Now if you are paranoid or have paranoia than you probably are not aware of everything that can be done to keep security tight.
My recommendation:
Patches! Patches! Patches! Patch everything from workstations to servers! Especially if they are web facing! Overflows are a common way to gain control of systems and all too commonly they only happen to the critical web-fronted servers. Enforce patches for all systems through GPO and better yet deploy an internal WSUS server that updates frequently and so you can keep track of those problematic PC's that don't report in for patching.
Backups! Backups! Backups! Always know your backups are being performed of all critical data that is strickly for the corporation. Backup also of your system-critical servers along with a redundant solution.
Antivirus! One (1) per machine and a managed solution to perform network wide-sweeps and report to a central server. Assists in host infections and problematic machines/users. Remember that antivirus is to keep the system clean of common 'infections' not intrusions and also ment to keep the PC running fast and smooth. Too many defeat a primary reason for deployment.
Anti-Adware! One (1) per machine and for windows workstations, Windows Defender works great. Being an MSI it can be rolled out via group policy and monitored through event logs! Keeps the computer also running fast.
Firewalls! I am talking REAL firewalls, not your OS based firewall for the PC or even a software based firewall for the edge of your network. People use appliances like Cisco Pix, or ASA. because its not dependant on an OS and does ingress and egress and can be monitored very wall through syslog. Other good solutions are Checkpoint & Juniper/Nokia for coporate solutions. The first step in actually KNOWING what is happening on the network.
Proxy! Have all your users forced through a proxy so you can block them outbound at the firewall! A great place to keep your users on check or at least be able to perform forensics when someone does something stupid you can identify who and what.
Last and not least... Intrusion Detection System or Intrusion Prevent System (IDS or IPS)
These systems are much like anti-virus on hosts except they run on networks. All traffic should be duplicated so it can be monitored by port spans on switch or put them inline outside or inside your firewall. People doing the real damage will most often be seen by these systems whether its vulnerability testing/scanning on large network segments or if a real intrusion happens and someone is able to run a huge scan on the inside of your network, you can identify them and shut them down.
If all these can be deployed than let your paranoia fade away because you are doing one hell of a job.