Get SP2 installed, if not already done. Configure Windows Update to pull down any critical security updates.
I'm assuming you've got a firewall in front of the server? If not, configure the Windows Firewall (not very flexible on Win2k3).
Ensure your event log sizes are fairly big (>16K), configure them to overwrite as needed. Enable auditing.
Make your passwords very complex (include upper case, lower case, numerics and punctuation). Make them at least 10 characters.
Ensure any unnecessary accounts are disabled. Disable any unecessary services, use AutoRuns to stop as much stuff starting.
Run services using an account with the minimal privileges possible.
Uninstall any unncesesary applications / windows features.
Possibly install the Security Configuration Wizard.
Then, monitor, monitor, monitor. Use TCPView and ProcessExplorer.