I think point 7 needs a slight bit of expansion. -> Don't allow anything sensitive to be accessed from the outside world.

Creating a vpn takes seconds and provides a very strong wall between everybody who isn't you and your vulnerable services (ie. sql server/etc.)