Comment by tptacek

A phenomenal resource on the same subject:

https://isopenbsdsecu.re/mitigations/