Most hacks I am called in for could have been prevented by basics rather than by anything clever. Attacks usually start with something visible from the outside, so the work is reducing what is reachable at all: close unused ports, remove network-facing services you are not using, keep software current, and do not leave a management console exposed. I have written this up as five practical server hardening tips, as a look at the security holes shared hosting leaves open, and as a specific case of putting a firewall and proxy in front of a VMware ESXi console.