This is a huge topic, but itpol/linux-workstation-security.md at master · lfit/itpol is a good starting point.