Command Center

Basics: Updates, Firewall, secured Admin account (renamed, very good password). Then get the Best Practices Analyzers for SQL, IIS, and Server; run them and see what their recommendations are.

Microsoft® SQL Server® 2008 R2 Best Practices Analyzer

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0fd439d7-4bff-4df7-a52f-9a1be8725591



Best Practices Analyzer

http://technet.microsoft.com/en-us/library/dd759260.aspx







REFERENCES

http://serverfault.com/questions/269121/how-to-lock-down-a-windows-2008-server-before-connecting-it-to-the-internet