* Disable root login
If you have root login enabled by default, you're using the wrong distribution. This is 2011, not 1996.
* Change the SSH port
Why are you doing this? What will you achieve by it? In what way does this reduce your overall risk of compromise, and by whom?
* Install fail2ban or denyhosts
That's the only thing out of your trifecta that should be in there. Aside from that, here's why your trifecta isn't a good move:
You're still using password authentication for SSH. Switch to public key authentication. This, combined with fail2ban or denyhosts means bots are not getting in. Period.
You aren't addressing your attack surface area - look at what information assets are exposed to the wider world and how. Once you know what your information assets are and how they can be accessed (either legitimately or unscrupulously) from the outside world you know what you have to protect and how people can get to it. That way you can focus on real countermeasures.
What about your applications? Have you checked your code to make sure you're validating input correctly? How are you protecting against SQL injection or Cross-Site Scripting? How are you handling state?
I put to you an alternative trifecta:
* Know your assets
* Know your threats
* Use appropriate measures to protect your assets from your threats.