Before we deep dive into all the great security measures you can take, here are some some tips and advice regarding security.
Security implementation on multiple levels is, in general, a good idea. This way, a hacker needs different approaches to gain access, and this costs time. Because of this time, and hopefully also because of logging and monitoring, you have greater chance of detecting them.
But, and there is always a but, don't take that too far. If you can't access a service, it's difficult to troubleshoot where the problem is. And if it's too complex, it's more likely that you are going to make mistakes.
For files and directories, the Discretionary Access Control (DAC) is still a very good foundation. Make the permissions on files and directories as strict as possible. Check the owner and group ownership, use access control...
