We could give you a more detailed answer if you tell us what service you want to provide on this public facing Windows box. e.g. IIS, OWA, DNS, etc?
To lock the box itself down, start with vlad's answer by removing (or not installing to begin with) any additional services/roles on the box that won't be needed. This includes any 3rd party software (no acrobat reader, flash, etc) that should not be used on a server. Any of course keep things patched.
Configure your firewall policies to only allow traffic to the appropriate ports for the services you are running
Configure an IDS/IPS with rules associated with the services you're running.
Depending on the risk/value of the asset, consider installed a host-based IPS in addition to your perimeter IPS preferably from another vendor.
Assuming the primary purpose is to host a website, locking down IIS is significantly less trouble with 7.5 (2008 R2) though you should still make sure that you do a few things such as:
- Store website files on a different volume from OS files
- Grab a XML security template from Microsoft, NSA, etc as a baseline
- Remove or lock down via NTFS all scripts in
- Lock down dangerous exe's such as appcmd, cmd.exe, etc
- Use IPSec to control traffic between the DMZ and authorized internal hosts
- If you need AD, use a separate forest in your DMZ than your internal network
- Make sure all sites require host header values (helps prevent automated scanning)
- Enable windows auditing of all failed and successfull events except the following successful events: Director Service Access, Process Tracking and System Events.
- Use NTFS auditing on the filesystem to log failed actions by the Everyone group and be sure to increase the size of your security log to an appropriate size based on backups (500Mb or so)
- Enable HTTP logging for the root folder
- Don't give unnecessary rights to user accounts that are running app pools.
- Get rid of ISAPI and CGI modules if you don't need them.
I don't want to make this too long so if you need/want more info on a particular bullet, please leave a comment.