You're quite right. Security Server is optional. All Security Server functionality is also co-hosted on Connection Server so with a small setup, you can have a Connection Server only. It must be Windows Server 2008 R2.

When you set it up, if you have any further questions, post a message on the Forum discussion pages and we'll help you out.

Mark.