The biggest thing I do for security reasons is never allow ssh with password logins. Always a key file. It is basically impossible to brute force a key file.

I've been reading about mitigation recently and how ideas from projects like grsecurity can reduce the impact of exploits. Also techniques to isolate processes like chroots, containers, jails.