the book Digging into Wordpress has an entire chapter dedicated to security, well worth the read