Not secure enough to leave it without a prophylactic. Does the word Trojans ring a bell? So go buy some
Seriously, if you have managed to keep up with all the security updates for IIS, PHP and MySQL you may be safe from script kiddies, but not from someone with skills. So you will need a Firewall machine, or a Router, and/or at least a software firewall.
Visit grc.com if you want a expert's opinion, but if you're happy with my opinion then go get yourself a Netgear RT314 and visit the Netgear forum at dslreports.com to learn how to set it up. And in addition to the router use Zone Alarm as your software firewall.
That should make you unattractive enough to make a potential intruder to look for easier preys. Unless of course you're doing ecommerce in your server. Then these suggestions are not enough to protect you from card chasers.