Also don't forget that security has to be an ongoing concern, and starting with a properly hardened image is not the end of it. You will have to daily monitor and remediate where necessary. You will also have to make sure your selected hosting company lives up to its name. You may have a properly secured machine, but it's only as secure as the infrastructure it sits on.
Considering 1K DRK is quite valuable today and likely to be more valuable in the future, don't just drop your Masternode out there in the wild like sitting ducks for script kiddies to compromise. If you get compromised, do not come back to complain about Darkcoin because this one is 99.99% on you (with the minor exception of wallet/client vulnerabilities).
is the DDOS protection required to keep the 1000DRK from being stolen by hackers, or just to prevent the masternode from being unusable?
Yes, DDOS variants can be used in support of security attacks but in reality it's more of a continuity of operations concern. You are likely to lose fees due to it rather than have your system compromised. Your selection of host should definitely offer services for DDOS prevention.
thanks for the info, do you think the free package offered by cloudflare for example, would provide sufficient DDOS protection? How easy is it for a masternode to be DDOSed?
Free services usually protect you with certain limits, i.e. certain protocols, certain amount of bandwidth, type of attack, etc. I could not find the necessary technical detail so you may want to take that question to Cloudflare directly. Their advanced service however promises they will attempt to mitigate all forms and sizes though I believe there would be a fine print with limitations there also.
Best is obviously to not leave everything to the hosting provider and layer your defenses as much as possible. Even come up with contingency plans with different hosting providers, etc. Sounds complicated but if you think of deploying multiple Masternodes and make money off of the associated service, definitely worth your time.
Again a reminder, DDOS is a must for considering but making security a daily concern is higher. DDOS is not likely to cost you 1K DRK but a simple vulnerability followed by a compromise will.