Use a trusted distro like Ubuntu LTS. Install security updates automatically.

Be aware and focus specifically on which ports/services are available from the internet.

If you absolutely need SSH, ensure you use something like fail2ban and use complex credentials. If possible, use obscurity to change from the default port of 22.

If you're running an internet-facing service, like nginx, ensure that it's always up to date.

Using SELinux and AppArmour and GRSecurity are usually way overkill and cumbersome to manage.