1) latest updates.
2) run IDS, and keep checksums of files that aren't supposed to be changing.
3) consider putting in a system for versioning files that aren't supposed to be changing.
4) don't run software that isn't necessary.
5) isolate processes and services as much as possible and run with reduced privileges to the lowest level possible.
6) subscribe to security and user mailing lists for software you use, like Joomla groups and software you're using for your servers.
7) backup backup backup
8) format and reinstall your server from known-good source. You don't know how far the compromise goes back or what rootkits or other issues have been introduced.
9) install monitoring software on systems for your switches, routers, firewall...get to know "normal" traffic patterns from anomalies, then investigate when something starts looking weird.
10) stay familiar with your business's servers and workflow. Familiar enough that you can just "Feel" when something isn't right with the servers. Investigate. Check logs.
11) configure remote logging to a secured server. Compromised systems easily cover their tracks when the logs are local.
12) pick up some books on system security or delegate someone to be in charge of updates, security issues, etc.
13) isolate Internet-facing systems from your internal development, backup, etc. systems. Backups are no good if your internal systems are monitored by loggers and sniffers.
14) keep researching server security with books and articles online, since this site cannot possibly cover everything you should know if you want to protect your business (and your customers) on a topic like that.