The Linux Foundation published a guide recently[1] which has recommendations for desktop.<p>Take into consideration that unless you&#x27;re running SELinux in full-enforcing mode (<i>NOT</i> targeted-enforcing, the default!), you still have a HUGE attack surface on your machine if you&#x27;re using a web browser alone.<p>This presentation[2] also goes into some detail about an overall layered security approach and touches on workstation security.<p>If you really-really-really need security, you could consider something like QubesOS[3] to segregate your applications.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;lfit&#x2F;itpol&#x2F;blob&#x2F;master&#x2F;linux-workstation-security.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;lfit&#x2F;itpol&#x2F;blob&#x2F;master&#x2F;linux-workstation-...</a><p>[2] <a href="http:&#x2F;&#x2F;kernsec.org&#x2F;files&#x2F;lss2015&#x2F;giant-bags-of-mostly-water.pdf" rel="nofollow">http:&#x2F;&#x2F;kernsec.org&#x2F;files&#x2F;lss2015&#x2F;giant-bags-of-mostly-water....</a><p>[3] <a href="https:&#x2F;&#x2F;www.qubes-os.org" rel="nofollow">https:&#x2F;&#x2F;www.qubes-os.org</a>