Firewalls and exposing only what you need

A firewall decides which network traffic may reach a machine. On a single Ubuntu server, ufw is the friendly tool for this. Deny all incoming traffic by default, then allow only ports 22, 80 and 443.

Rules can also match where traffic comes from, so SSH can be limited to your own IP address. The same thinking carries into cloud security groups and Kubernetes network policies. Start with nothing allowed, and open each port for a reason.

Databases, caches and admin panels should never face the internet. They belong on a private network, reachable only from the app.