Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance. There are a couple of questions here about that topic:
Here is another helpful question/answer about security and Civi, but with reference to Joomla (same principles apply really): Installing CiviCRM - best security practices
Agreeing with Erik, using SSL is at the top of the best practices list (you can check your site's security for free with https://www.ssllabs.com/ssltest/). With "SSL" as a practice though, you will want to adjust your ciphers to disallow known vulnerabilities. Limiting your server to just TLSv1.1 and TLSv1.2 is becoming the standard (and just TLSv1.2 is preferred if you don't need to support older browsers). Our payment vendor (iATS) requires the use of a service like TrustWave that scans our setup once per month (and ad hoc as needed) and lets us know of any vulnerabilities and updates needed to maintain PCI Compliance.
As a piece of that, you will also want to make sure your whole site defaults to HTTPS, not just the Civi sections. Google's search results looks favorably on sites which are entirely HTTPS, and with HTTP/2 now becoming a reality for folks, the speed hit should be mitigated (somewhat). Lullabot has a great deep dive on the topic: HTTPS Everywhere: Security is Not Just for Banks
As far as server practices go, keeping OpenSSL and OpenSSH updated are crucial. Closing ports that are not used, or limiting them based on IP address, is another helpful step to take.
A perhaps obvious step to take is to double and triple check your Drupal and Civi permissions and make sure access to data is limited to only those parties who need it and nothing more. This is especially pertinent if it's been a while since the CMS and Civi were first installed. Time often creates complacency.