blocking FIN NULL and X-MAS on network scan

How do you prevent a hacker from launching FIN, NULL, and X-MAS scans on your network?