I'm amazed noone ever mentions GRSecurity as must have. It will reduce the risks of an actual comprise significantly. Non-patched Linux is always full of rootkit potential.
To be fair I'd just use FreeBSD which has a little better kernel architecture with respect to security.