Approach To Security

As websites are becoming a new and increasing vector for malware attacks, I believe that we as a service provider should carry some responsibility for helping prevent this.

Currently my approach is that of user education (notifying of important patches to the major software I know are used on my servers - phpBB, IP.Board, etc) as well as a weekly cronjob running clamscan on the /home directory identifying any viruses (which is currently doesn't, apart from the EICAR test file I have in my home directory to ensure that it works).

However, is this all I can do, or is there more? Is weekly enough for a virus scan? It's quite an expensive job to run CPU time wise, so I don't particularly want to run it too often.

Is ClamAV a good enough tool for dealing with web-based threats? It's reviewed well for a virus scanner, but I'm not sure how appropriate it is for what I want (I use it for mail scanning also). I've been considering using Sophos Anti-Virus instead.

What are your approaches to preventing web-based malware being delivered using your servers?