The most commonly used WWW server alternative to IIS is Apache, of which the UIS have considerable experience. Apache is multi-platform and free. The main site dedicated to Apache is http://www.apache.org. Apache is provided as the default WWW server in Mac OS X and many Linux/Solaris applications.
Apache Configuration and Security
As with any other Windows product running on a server you need to make sure that you keep your server(s) patched from the system point of view. Installation and configuration advice tends to be more version specific and can generally be found in the documentation of that version.
Apache General Security
Like any other commonly-used commercial or non-commercial product Apache has vulnerabilities which are announced from time to time. It is wise to check periodically for security problems with your particular version. Such announcements can generally be found http://httpd.apache.org/security_report.html here.
Managed Web Service
If you have a requirement for a web site and are not experienced running Windows systems and not a techlink you should seriously consider the managed web service as offered by the Computing Service before you run your own server for an institution or research group.
See http://www.ucs.cam.ac.uk/managed-web-service for full information
MCS Personal Web Pages
If a personal web site is required then you have the option of the MCS personal web pages, see http://www.ucs.cam.ac.uk/managed-web-service/personal-web-pages
More likely users will want to use a service such as My Space, which removes the localised security threat to a degree, but does have some other potential issues.