Best Windows Server 2008 R2 security setup?

Question

IIS

I took a dedicated server on Windows Server 2008 R2 Web Edition (from OVH.COM).
The server will run IIS + SQL Server Express 2012.
There will be only 1 site, which will be used only by company employees.
When the site was working inside the intranet, all the settings were by default and that suited me. But since now the server and the site will be available on the Internet, increased security requirements have appeared.
Prompt or give links to the guide for configuring iis and sqlexpress security for combat conditions.
We need maximum security.
Access to the site will be only via the https protocol (I created a free SSL certificate from startssl).

Answer 1

создал бесплатный SSL-сертификат от startssl
and
Нужна максимальная безопасность.
poorly compatible ...
I advise you to immediately take Server 2012 Datacore - and so it’s standard, firewall (you can do it as standard), user settings, running IIS with reduced privileges, and also restrict data upload. The rest depends on what platform the site has ...

Answer 2

IIS 5.0 Baseline Security Checklist
In general, I use the following query to Google:
% product% security baseline
Helps to quickly and efficiently weed out unnecessary =)