A good protection network will use multiple types of protective devices which compliment each other. To be able to withstand lightning strikes, a common first device is a gaseous discharge tube - a spark gap. During an overvoltage event these can conduct thousands of amps but the voltage at which they activate is relatively high and cannot be made precise: +/- 20% is what you might expect to see.
After the GDT, you might have a metal oxide varistor. These also conduct when the voltage across them rises to a preset level, but they're more precise (+/- 10%). They cannot conduct as much current as a GDT, but they're just working with whatever is left over after your GDT did its job.
Finally, you might have a transient voltage suppressor - a kind of Zener diode. Same story as before: even more precise than a MOV, but at the expense of current handling capability.
On top of all of this, you have to take into account how all these devices are interacting with the line you're trying to protect: leakage current, additional capacitance, etc. If you're trying to protect a high speed data line, my suggestion is not to roll your own, but to buy a premade network that is designed for the line where engineers have already thought about these things.
