There are tools to keep up to date with both operating system and application patches and configuration tests. Some of them include best practices. You can run them on a regular basis to get a picture of your security posture. You can even write your own rules, after much study, to ensure that systems maintain your planned configuration.
The US Department of Homeland Security is the front for a very large effort to develop open standards for security products. They and their contractor Mitre have developed a language called OVAL that is the Open Vulnerability and Assessment Language. It uses a combination of "platforms" like Windows, Linux, and Cisco IOS that various scanning engines have to support. These scanning engines then take "definitions" of specific tests to execute against the host or target and produce a report.
If all of this sounds very generic, it is. On purpose. This allows Debian to issue their own "definitions" on their website once. They don't care what tool does the scanning or reporting. No GUIs required. A free scanner and results writer, the OVAL Interpreter, can be downloaded from sourceforge.net. Instructions are also available.
Now that you have tools to verify that your applications are as secure as possible, you can continue providing protection at the network layer against specific attacks.