Even if you have a single server to run a bunch of services (web, mail, ssh, file server etc), best way to raise the security bar quickly is to isolate these se

Even if you have a single server to run a bunch of services (web, mail, ssh, file server etc), best way to raise the security bar quickly is to isolate these services from one another. Use one of the modern virtualmachine/container technologies with minimal footprint to do this. Ideally, you would want physical separation between a node running firewall/loadbalancer and the servers behind them. If you are running a large cluster of many servers, then you definitely want to plan and separate your architecture into different layers of separations. Don't forget your own laptop from where you login to administer all this is the best chance an attacker has to breaching all this security. So, ensure there is good role separation for administrators and good security hygiene on all the individuals machines (use password managers, do only official work on these laptops, don't visit random websites, run vetted authorised packages only). For highly sensitive stuff (like CA or any root of your chain of trust), setup a SCIF and use only terminals inside a SCIF to access/administer them.