As a newbie, this is what I do: - I put all my servers on a private network (e.g., db server, web server, monitoring server) - The only server exposed to the

As a newbie, this is what I do: - I put all my servers on a private network (e.g., db server, web server, monitoring server) - The only server exposed to the internet is my load balancer (usually nginx) and a bastion server - The bastion server only runs SSH. It's hardened (how good? I don't know; I just try to follow "best practices") and nothing else runs on it - I access my internal servers via the bastion server Not sure how secure my setup is, but I am not a "sec" guy, and the above setup is already above my average knowledge of software engineering (which is what I usually do). I know I could go for a VPN, or pay a saas to have better security, or use SELinux or what not...