Dedicate this device / VM purely to running your validator node clients to minimise the potential attack vectors
Always use long and unique passwords whenever required. Use a good password manager (e.g. ) to maintain the various passwords you will be creating BUT NOT YOUR UNENCRYPTED SEED PHRASE
Disable password login via SSH - i.e. only use SSH keys for remote access
Only SSH into your server using a trusted network connection - e.g. home, office. Some examples to avoid are public WiFi network at cafes
Disable root account logins. In this guide we disable this via disallowing root login via SSH as we will never have physical access to the server
Only open necessary ports and close them when they are no longer in use
Configure automatic system updates to stay up to date with the latest security patches continuously
Configure brute force protection
Verify the checksums of all downloaded zipped files before executing them
Consider using a good VPN (e.g. NordVPN) to mask your IP address
Secure your client machine by avoiding risky activities in general on this device - e.g. downloading pirated software or content, watching porn, clicking or downloading unknown links, signing unknown transactions
Check your system monitor for unknown applications taking up a large portion of CPU or memory periodically and especially before you SSH into your server
Store your SSH private keys in an offline USB drive when not in use