One thing you should probably do: establish a VPN.  Give staff cert-based credentials to it.  Block all inbound traffic to the VPN except a) port 22&#x2F;etc to your bastion host and b) 80&#x2F;443 to your front-end web boxes.<p>This greatly reduces your surface area, and helps prevent easy mistakes later (like leaving a staging server unpatched) from blowing up your whole deployment.<p>Also, admin applications: an easy way for smart teams to lose.  These are a great candidate for &quot;only accessible if you&#x27;re VPNing in&quot;, which you can enforce at firewall and again in the application if you want.<p>Password managers; TFA everywhere but especially on corporate email accounts; ask yourself &quot;If I were a hobbyist building a Bitcoin exchange where would I host it?&quot; then don&#x27;t host there.<p>Here&#x27;s a useful but hard-to-implement recommendation: keep an up-to-date list of every box in use and terminate anything you find not on that list.  Many compromises start with &quot;The summer intern&#x27;s project from last year was web accessible and...&quot;