Firewalled for limiting untrustworthy connections to the computer(public networks, hotels, even work).
apparmor for protecting the kernel and controlling file access to applications. SELinux is also a good option but if you need to load kernel modules, it can take a few minutes to sign and register it. It is automated on redhat systems though.
Other than that, do your research and don’t run random scripts and install random apps.