Limit what can be reached
Expose only the ports required by the service. Administrative interfaces should have additional access restrictions. Review containers and IPv6 listeners as well as host-level firewall rules; a hidden alternate path can bypass an otherwise careful policy.
Limit what can be done
Use separate service users and narrowly scoped credentials. Avoid running an application as root unless it needs that privilege. Separate production and experimental environments so a compromised test tool cannot reach every secret.
Patch with a recovery plan
Follow supported releases, install security fixes and schedule necessary restarts. Read major upgrade notes and test compatibility. Keep a known-good backup and rollback procedure so fear of downtime does not turn into indefinite postponement.
Notice meaningful changes
Monitor authentication failures, unexpected processes, disk growth and application errors. Logs are useful when they answer a question, but they also need retention limits and access control. If compromise is suspected, preserve evidence safely and rebuild from a trusted source.