What steps can you take to defend against network mapping (i.e. with tools like nmap or Nessus) from someone already inside your border firewall? What ongoing exposure do you still have even after you’ve taken those steps?

Networking:

To become defend against network mapping you need to close all ports and set up a good firewall(this just make it harder) buy a router with DDoS protection.