When you're thinking about the security of a web server, it's a good idea to think about the worst case scenario. What if the machine (or the data/programs on the machine) is destroyed somehow and you need to get back up and running as soon as possible? A disaster recovery plan is an important security feature, and it's one that you need to practice to get right. Do you have scripts in place that will reinstall your web applications as soon as the sysadmin plugs in a new box with a fresh, blank, patched OS?

I happen to be using PowerShell to build some of this out for Pluralsight, and hey, like most of us, I'm still learning it.