Ok so this is probably a basic question but I would like to expand my knowledge.
I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a website that will be available to the Internet. Secondly a password protected user environment where suppliers can view things like invoices and create new users ect.
So what I am basically asking is where do I even start to secure this environment. What would be the best steps to secure the server. It runs Nginx, Python and php .
Any input would be highly appreciated, I have a basic understanding of security having studied security at honors in uni, but that was a while ago and theoretical knowledge is useless compared to practical knowledge which I lack.