This is a subject i know a good deal about having a professional background in information security. I'll tell you what i do.
!!EDIT NOTE!!: It's a good idea to get a snapshot/backup of your VPS host BEFORE making these changes in case you lock yourself out by a mis-configuration.
1. Seriously consider getting your VPS from Commercial Network Services. They are very reputable and reliable and have 3 datacenters to choose from. However the primary reason is because they offer a free 2-Factor authentication. This means you will get a 2nd login challenge code texted to your mobile phone or optionally your email. This helps defeat login attacks. If you want this request it via a ticket to CNS support.
https://www.commercialnetworkservices.com/2FA/ https://www.commercialnetworkservices.c ... s/Traders/
Alternatively checkout
https://www.phonefactor.com/ or
https://www.duosecurity.com for free 2FA addon to non CNS servers that supports RDP logins.
2. Change the default port for RDP (Remote Desktop Protocol) to a random high port (valid TCP high ports are 1025-65535).
Manual
http://www.techrepublic.com/blog/datace ... erver/1939
Automatic
http://helpdesk.commercialnetworkservic ... itemid=101
Note: Don't forget to make sure the Windows firewall has the new port rule (e.g. TCP 33333) for it to work.
3. Minimize your web browsing from the VPS. Web browsing it probably the most likely infection vector for malware so only use the browser for things like grabbing an updated EA from the forum and such.
4. Make sure all Windows updates are done expeditiously when available. Microsoft releases new updates the 2nd Tuesday of each month. I set the schedule for Control Panel > Windows Update to apply updates every Friday after the market closes if any are available.
5. Install anti-malware programs and run them occasionally. What i do is install all my common apps from
https://ninite.com/. I like MalwareBytes and Spybot for anti-malware. For my regular AV i run Clamwin as it uses minimal resources.
http://www.clamwin.com/. Personally i don't run these programs in real-time but, on demand when i want. If you don't web browse from the VPS you have much lower risks to the VPS so you don't have to run them but, occasionally.
6. If you're really concerned about web browsing you can run your browser sessions in
http://www.sandboxie.com/ as i do to sandbox (isolate) web browsing.
7. Uninstall IIS if the VPS your rent is deployed with it already installed. I don't see a need for it with RDP. Removing it reduces attack vectors and reduces resource usage (e.g. RAM) for having the components loaded.
8. Change the default Administrator login name via the Windows local security policy rule.
Control Panel > Administrator Tools > Local Security Policy > Local Policies > Security Options > "Accounts: Rename administrator account". Change it to anything different (e.g. admin). DON'T FORGET IT! Anyone hacking will try this account named as it's default. Renaming it means they have to guess the password AND the username further increasing the difficulty.
9. Make sure you don't have any other programs Internet accessible by default. Sometimes VPS vendors will preinstall applications that are open to the Internet. An example would be another remote access application like "UltraVNC". Any application open to the Internet must be kept up to date with updates for security. When you first get your VPS review what is pre-installed and anything open to the Internet you won't use consider uninstalling. Whatever you keep that is open to the Internet, you must keep it up to date with updates. I prefer RDP over all other remote access programs.
10. Be sure to check when you first get your VPS and occasionally thereafter to insure your Windows firewall is enabled.
11. Use a sensibly strong password.
http://tinyurl.com/68azzn
12. In lieu of a 2FA solution VERY VERY advanced computer users can consider implementing a Terminal Services (RDP) anti-brute force tool like >
https://github.com/EvanAnderson/ts_block OR
https://github.com/jjxtra/Windows-IP-Ban-Service/
These next few are indirectly related to protection of your VPS.
13. Don't keep your passwords (VPS or otherwise) in the clear in your mailbox. Occasionally mail providers are hacked so your accounts can be at risk if your password sits in the clear in your mailbox. What i do is use Keypass (
http://keepass.info) to store my passwords encrypted and place this on Google drive for high availability. Then i delete any sensitive info out of my mailbox.
14. Consider enabling "2Step" (2Factor auth) verification for your accounts like GMAIL and banking. Most often this will involve a 2nd login challenge code texted to your mobile phone. It's an inconvenience but, it will help maintain your security.
15. If you keep sensitive info in files on an online drive (gdrive, skydrive, etc..) consider Boxcryptor (
https://www.boxcryptor.com/) to protect your files.
You'll greatly reduce the probability of a security incident by doing most of these things. If you have questions post and i'll try to answer them. You are also welcome to PM me if you need Infosec advice.
Thanks.