Linux workstation setup -- security tuning

(Part 2) How to configure linux laptop so that it can serve as a workstation that meets sensible security baseline?