And slashdot ruined my formatting.

Tips / Thoughts Always change the default password and default keys. A lot of exposed *nix processes should be sandboxed, jailed, or at the very least chrooted. The file system itself should support role-based and / or mandatory access control and have permissions set accordingly. Centralized control with periodic audits should be regular practice. There should always be a baseline and deviations should always be documented. For machine-to-machine communication, asymmetric key pairs should be part of the equation. This is already built into certificate-based mechanisms. There was also a recent addition enhancement to OpenSSL for stronger ECDSA keys. It should be some time before elliptic-curve cryptography isn't enough. Another option available for SSL and TLS is that both sides must have key/certificate pairs before communication is possible. More exotic is placing HTTPS certs on load balancers so that traffic is encrypted there instead of the actual web servers. Doing this allows inspection of inbound HTTPS. Intrusion detection systems normally can't see this due to the encryption. Load balancers also do a great deal to control exactly where traffic goes. Network traffic should always be monitored and profiled. For an interactive session, go with multi factor authentication. There are a lot of cool services out there. Duo Security is a great example. The YubiKey authenticates are cheap and because they've open-sourced a lot of their software, it's easy to integrate many applications with that type of authenticator. Even ssh. You can even run your own (protected) YubiKey server to control the authentication. Authy is another option which is easier to implement. SmartCards are also an option if you have deep pockets. Randomized and one-time-passwords are also great but are tricky to implement. Most organizations that use these end up with enterprise password repositories. As long as these are protected by layers of security, they are usually a good idea. There are various situations where you wouldn't want someone to have a password that could be used more than once. This is the stuff I've learned while working in the cyber security field for the past year. I've also learned that most organizations don't do any of this proactively. Phew. Typed all this using my thumbs on an insecure iPhone.