Securing a server is a set of habits, not a single action. Here is the checklist I run through on every new machine before it goes live.