Thanks a lot…

While UFW may be adequate for private computers and servers, it is not robust enough to protect corporate servers as evidenced by all the breaches of corporate data centers. I am sure that Equifax, Target, Yahoo, et al. used industrial-strength security suites much more robust than UFW, nevertheless they were penetrated.

Speaking of security suites – while you mentioned malware as a multifaceted threat, you did not mention installing anti-malware software as one of the basic means of securing a server. It can be argued that anti-malware is just as, if not more, important protection as a Firewall. A Firewall will not stop viruses, Trojans, and/or other malware from infecting and ravaging a server.