You could use nmap to get a better view of the (network)services it is running:
nmap -sS -v <your_server> -sV -p1-65535
and lsof to view the current inbound/outbound connections to the box.
If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended that strong(>8 characters, alpha numeric, upper case, lower case, special characters) passwords are used(with SSH some argue it's better to use public key authentication).
For added safety you could also install fail2ban and run an updating script regularly(i.e. as a cron job).
For example, an update script(on Debian/Ubuntu) may look like:
sudo sh -c "apt-get update;apt-get dist-upgrade;apt-get autoremove;apt-get autoclean"
Installing fail2ban on Ubuntu/Debian can be done using:
sudo apt-get install fail2ban
In order to configure fail2ban it is recommended to make a copy of the default configuration file:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
and work on the copy:
sudo vim /etc/fail2ban/jail.local
The most relevant entries are ignoreip, bantime, findtime and maxretry.
Increasing the bantime and maxretry values statistically improve security.