Beyond this, most of the administration is left to the user and it requires a good working knowledge of Linux. Security Progeny follows Debian's security model. That is, they work really hard to include only software that is inherently secure. Like anything else, this doesn't guarantee that there are programs that can't be exploited, but it does lessen your chances. For example, instead of including sendmail, the famous mail transport agent, they include Postfix.
Postfix is well known for being much more secure than sendmail and easier to configure as well.
It is the small touches like this that add to Debian's reputation for being secure right out of the box. Other nice touches include things such as not having many daemons running by default. Telnet and FTP, two of the easiest daemons to exploit, are disabled by default with SSH enabled in their stead. Almost anything else that would be running as a daemon, such as the Apache web server, needs to be explicitly enabled. This runs contrary to many Linux distributions that have almost all server processes enabled by default.