We are still actively working on the spam issue.
I wrote a fairly long section dealing with security on the server article. It is server-specific, so doesn't cover things not relevant to servers (like securing your user account), and covers things relevant to only servers (like fail2ban). I still had to talk about general things (security model) to make it meaningful. Maybe we should move that here and link to this page from the server article? --Thelismor (talk) 21:10, 10 April 2015 (EDT)
We should add sandboxes and maybe firewalls, fail2ban and even dnscrypt (prevents mitm), but I have no idea how to go about shoehorning them in. Perhaps a re-write of the 'Practices by tool' section is in order.
Eventually I will write an article on firewalls and another one on sandboxes and shoehorn them in, but for now, we need to at least add the recommendations.