You could use **nmap** to get a better view of the (network)services it is running:

    nmap -sS -v <your_server> -sV -p1-65535

and **lsof** to view the current inbound/outbound connections to the box.

    lsof -i

If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended that strong(>8 characters, alpha numeric, upper case, lower case, special characters) passwords are used(with SSH some argue it's better to use public key authentication). 
For added safety you could also install **fail2ban** and run an updating string regularly(i.e. as a cron job).

For example, an update script(on Debian/Ubuntu) may look like:

    #!/bin/bash
    sudo sh -c "apt-get update;apt-get dist-upgrade;apt-get autoremove;apt-get autoclean"

Installing fail2ban on Ubuntu/Debian can be done using:

    sudo apt-get install fail2ban

In order to configure fail2ban it is recommended to make a copy of the default configuration file:

    sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

and work on the copy:

    sudo vim /etc/fail2ban/jail.local

The most relevant entries are **ignoreip**, **bantime**, **findtime** and **maxretry**.

Increasing the **bantime** and **maxretry** values statistically improve security.