You can use Achilles to check for get/post data that should/should not be there, or be editable, use something like nessus to check for vulnerabilities in your server technolog(y/ies).
You asked what are the 'n' things that should be done to ensure security, well, you could do many things, it depends upon how far you want/need to take it. First things first, always ensure that the code written for the application is secure (that being that it doesn't keep track of any information such as usernames, passwords, and other such things for anything more than page scope, because unless it's on HTTPS it won't be encrypted), make sure that any underlying connections are secured (i.e. dissallow root login to MySQL from anywhere except the machine), and keep any passwords for the web application encrypted in the database, I personally like to md5 them before putting them into the DB, and then md5 them before I check them against the DB., You could also make a habit of changing passwords one every 2 weeks or so, always making them completely different. Use role-based access control on the application, etc.
Always remember to ensure that your system is patched and updated...
Tools that check security are always good, but security should never be an after thought that is overlooked until project completion, instead it should be part of the system implementation from its inception.
For secure programming techniques, I'm sure google has a wealth of information regarding this, just search for secure programming.
Good Luck,
