Running every service as a separate user. Once I get FreeBSD going, I'm going to look into Jails.

On my laptop, I'm behind a firewall most of the time, but it uses a VPN when it detects it's not connected to my home network. Each SSH key has a passphrase. Screen-timeout of 2 minutes, auto-shutdown of 30. Don't have a /home/ on my laptop, so I only encrypt /var/ and /etc/

I have all the well-known privacy extensions for Firefox as well.