For the really paranoid, such as myself:
1. Lock down who has access to the system via network and locally in the Local Security Policy.
2. Set IPSec filters, or a firewall, to block all incoming traffic to the system, then open the system to the traffic you specify, i.e. HTTP, HTTPS coming in to the system.
The advantage of a firewall, like ZoneAlarm Pro or some other, is that it will give you pop-up messages for the attempts on your system.
IPSec is fine for most, and is free.
3. Encrypt personal private data on your system to keep the inquisitive users who have access to your system out.
4. Get a "cleaner", such as Internet Washer, to remove all traces of where you been on the internet from your system--even those hidden files Microsoft likes to keep :(
5. Use a free e-mail account for those sites you visit, that will spam you later.
6. Use a browsing tool, like Anonimizer, to block your system information from the sites you visit.
That should get you started.