To have the latest security updates the OS should be at least Windows Server 2008 or later and have updates downloaded and installed. This will ensure that ASP.net is secure this is the benefit of ASP.net over others that is updated automatically with the system.
Also if the windows server is the 2008 not the 2008 r2, IIS 7.5 should be installed that has the best security update to date. IIS (Internet Information Service) is the server which can run ASP.net sites.
Firewalls and Anti-Virus Software
Some of the main features that need to be set are the firewall and the Anti-Virus.
The firewall should set to close any ports that are not need, this can be a third party firewall or default OS firewall, and all firewalls are good it only how they are set that makes the difference.
The anti-virus should be a good one and regularly for new virus definition if not malicious software can harm the system and also harm the site. Malicious software can also infect users that enter the system.