Where would I go to learn to set up a really, really secure system that DOES expose external services (out of a standard Windows or Linux OS). Note that I am not looking for a favorite choice between Linux and Windows, as the choice is not likely to be mine to make. However the level of security needs to be military grade.
OWASP is a good place to start. However, read my comment above. Also start with a secured OS and open things up as needed.
One way to approach the security/services open to internet combination would be through some VM technology like CentOS/Xen (or MS HyperV or VMWare or KVM or plane old VirtualBox). Each VM can have a unique IP which could be put in your router's DMZ. You can have have VM backups and mirrors for redundancies. If you went the Xen route I suppose Xen Wiki is where you would want to start.