• Remove unnecessary software, boot scripts
• Importent Daemons runs chrooted
• Integrity checker (tripware)
• Way to access firewall
• Configure anti-IP-spoofing rules
• Deny by default
• Strictly limit incoming traffic
• Strictly limit all traffic out of the DMZ