Here are some of the best practices that we as Ubuntu Server administrators can follow to keep the system safe and secure, and to avoid any issues that may occur due to users' negligence and/or forceful attempts to access restricted areas. This list is a good starting point, but not exhaustive:
Be sure to enable only SSH-based logins.
Provide users with limited access to files and software. Make sure that proper ownership is applied everywhere.
Create a password policy and encourage users to change their passwords periodically. Also, check whether your server needs a setup to lockdown users after a certain number of failed login attempts.
Allow only certain ports that are in use by your applications. Make use of the UFW features for this.
If you intend to use your server as a mail server as well, then it is best to enable TLS on it.
Allowing access to MySQL from localhost can enforce security to a great level.
This goes without saying, but a reminder is always helpful...