Firewalls and security groups
Close every port you do not serve. Scan a server like an attacker, shut the open database and SSH ports, allow SSH only from your own address, and let the database talk only to the web tier. This interactive lesson needs JavaScript.
