This is a reasonable jumping off point for someone newly interested in hardening a bare-metal Debian deployment. [1,2] are also quite good.

[1] https://github.com/Whonix/security-misc

[2] https://forums.whonix.org/t/fixing-the-desktop-linux-securit...