Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly?

My file permissions are set to 644 and my directories are set to 755.

[ec2-user@ip-xx-xxx-xxx-xx my_sub_directory]$ ls -l
total 160
-rw-r--r-- 1 ftpuser 65534   395 Jan  8  2012 index.php
-rw-r--r-- 1 ftpuser 65534 19929 May  6  2012 license.txt
-rw-r--r-- 1 ftpuser 65534  9177 Jun 21 17:26 readme.html
-rw-r--r-- 1 ftpuser 65534  4663 Nov 17  2012 wp-activate.php
drwxr-xr-x 9 ftpuser 65534  4096 Jul 23 23:12 wp-admin
-rw-r--r-- 1 ftpuser 65534   271 Jan  8  2012 wp-blog-header.php
-rw-r--r-- 1 ftpuser 65534  3522 Apr 10  2012 wp-comments-post.php
-rw-r--r-- 1 ftpuser root   3596 Jul 23 20:27 wp-config.php
drwxr-xr-x 5 ftpuser 65534  4096 Jul 23 17:44 wp-content
-rw-r--r-- 1 ftpuser 65534  2718 Sep 23  2012 wp-cron.php
drwxr-xr-x 9 ftpuser 65534  4096 Jun 21 19:39 wp-includes
-rw-r--r-- 1 ftpuser 65534  1997 Oct 23  2010 wp-links-opml.php
-rw-r--r-- 1 ftpuser 65534  2408 Oct 26  2012 wp-load.php
-rw-r--r-- 1 ftpuser 65534 29217 Jun 21 03:02 wp-login.php
-rw-r--r-- 1 ftpuser 65534  7723 Sep 25  2012 wp-mail.php
-rw-r--r-- 1 ftpuser 65534  9899 Nov 22  2012 wp-settings.php
-rw-r--r-- 1 ftpuser 65534 18219 Sep 11  2012 wp-signup.php
-rw-r--r-- 1 ftpuser 65534  3700 Jan  8  2012 wp-trackback.php
-rw-r--r-- 1 ftpuser 65534  2719 Sep 11  2012 xmlrpc.php

And my .htaccess file attempts to further protect the wp-config.php file

# PROTECT WP-CONFIG
<Files wp-config.php>
Order Allow,Deny
Deny from all
</Files>

When I try to access my wp-config.php file from the browser like this:

http://ec2-xx-xx-xxx-xx.compute-1.amazonaws.com/my_sub_directory/wp-config.php

I get this error:

Forbidden

You don’t have permission to access /my_sub_directory/wp-config.php on
this server.

But when I access another file in my directory, for example, wp-cron.php like this:

http://ec2-xx-xx-xxx-xx.compute-1.amazonaws.com/my_sub_directory/wp-cron.php

I get a blank white page. I’m thinking, this can’t be secure.

So my question is, how do I properly secure the following files?

[ec2-user@ip-xx-xxx-xxx-xx my_sub_directory]$ ls -a
.            wp-activate.php       wp-cron.php        wp-settings.php
..           wp-admin              wp-includes        wp-signup.php
.htaccess    wp-blog-header.php    wp-links-opml.php  wp-trackback.php
index.php    wp-comments-post.php  wp-load.php        xmlrpc.php
license.txt  wp-config.php         wp-login.php
readme.html  wp-content            wp-mail.php