In shortStart with deny / Segment the coop / Log what you block / Practice failure.
1. Start with deny
Block everything, then open only what you need. If you cannot explain why a port is open, close it.
2. Segment the coop
Put the database in a different pen from the web tier. A fox who gets into one should not get into both.
3. Log what you block
Blocked traffic is a free map of what foxes want. Review it weekly and tune the rules.
4. Practice failure
Run a fox drill. Close the coop door, find what breaks, and fix it before it matters.
Written by Beatrice Featherstone, Head of Site Reliability. Disagree? Tell us. We read every message, usually before the second coffee.