If you are on a domain the most secure method is to use Windows Authentication only when you install SQL Server. If you have to have mixed authentication, you shouldn't rename sa, but you should disable it. You should still use domain accounts for DBA's, I actually recommend that this be a different account than your normal domain account, which you use only for doing DBA work. This way when you are logged in to your workstation with your regular account for email, etc... you aren't exposed if your workstation gets compromised.