I recently had discussion with my colleague about securing own's web server. According to him, a server is secure when you "show" what you want to show to public and what you do not want to be public is always inaccessible to them.

My questions:

Is it a acceptable definition of a secure server ?

How does file permissions affect server security ?

What are best measures to consider to secure own's server ?