Other than staying up to date on packages, this comes down largely to service config that’s independent of the OS.

Look into exploring SELinux and similar systems.