• secure your windows server and IIS
• place your SQL server behind a secure firewall
• follow the "hardening DotNetNuke Security Guide", available at the security page
• take care of passwords and verify all page and module permissions
• stay away from using FTP
• forget about the P-DNN tool, it just tried to guess the DNN version and listed all known security issues in it

I'd just add that one should keep a subscription to the Core Security blog (located here), along with the announcements forum (knowing when dotnetnuke.com is dogfooding a new version is a good heads-up to prepare for an upgrade).

I also personally run DNN in an application pool with its own identity, and only grant MSSQL execute permissions to that account (I elevate when upgrading or installing a new module) -- I don't recall if this is already in the "hardening DNN guide."  Some users might find this more trouble than it's worth.

Brandon