Yes, it is a very complex field of study. I am able to sleep at night by following as many of the best practices that are out there, even those I don't think ap

Yes, it is a very complex field of study. I am able to sleep at night by following as many of the best practices that are out there, even those I don't think apply to me. For checklists, look at the NSA's guide to hardening computers. You should also know exactly what services are running on your server, and dig hard through their manuals to learn more about how to secure them. Mysql, for instance, has 4-5 good tips on how to secure it which are in the security section of their manual. Finally, don't run services that aren't updated or aren't used. Reduce your potential attack vector to as few known points as possible, so that you can harden those points. Have a web server up? Turn off apache mods that you don't use. THat kind of thing. Turn on logging. Log everything. Check that you know how to analyze your logs. Make sure to rotate them as well -- opening 2GB files b/c you didn't rotate them daily sucks. Disaster recovery is a huge part of this. Think of it this way -- you're not a big target (I can tell b/c a big target would already have experts in this field). Chances are good that you have an exploitable part of your web app / site / server. You probably won't know of its existence until after an attack. At that point, you need to be ready to roll EVERYthing back to a known clean point. This is not an easy thing to do, so make sure you practice it. Those are just a few off my head.