Also, decent AV and anti spam and don't open email attachments without some prior analysis. Backups - good backups and check them at least weekly.

Actually just do all the boring stuff that IT Security have been recommending for years.