Two essential Joomla! extensions for security.
The first is Joomla! jSecure Authentication which moves your administrator page to a URL of your choice. For instance instead of your website admin URL being:
http://www.MyLameWebsite/administrator
it will now be something like:
http://www.MyLameWebsite/administrator/neptune_01wtr54
You see a lot of Joomla! users leave their admin page as per, AND leave ADMIN as the login ID - two critical pieces of information for hackers.
The second is Joomla! Lazy Back Up - which does an automatic, scheduled back up of your MySql database, and emails it to you all by itself. If somone does happen upon your admin page and hacks in, all you really need to do is reinstall Joomla!, add your template, and upload you saved database.
So if you update your Joomla site once a week, then get a back-up every week. The data is compressed, but if you have many sites it may be a good idea to set up a separate email for these back-ups, and select non-read email to be deleted once a month to avoid storage problems.