Make sure you have an admin who stays on top of the server.
Use the IIS Lockdown Tool
Use URLSCAN
Use the Baseline Security Analyzer
Use IPSEC
Disable Anon access for the SMTP Server...or if you are not going to use it, disable it.
Disable all Windows Services that you won't use...Telnet, Remote Registry etc.
A Windows Server is an Enterprise Server...and it takes a lot to get it setup right. Do some reading at
http://www.microsoft.com
95% of all web work I do is for Windows Servers and I have never had a security problem.
Don't take Setup lightly. It takes a while to get a new server tweeked out.