I would like to learn more about how to secure a webserver including topics like which OS to use, what policies to consider, which pieces of OSS are available that can help, what (human) processes are considered the best practices, etc.

I tried asking, "What is the “state of the art”, “best practice” in securing a colocated webserver, or EC2 instance running Linux?" on serverfault, http://serverfault.com/questions/474762/what-is-the-state-of-the-art-best-practice-in-securing-a-colocated-webserve, but it was closed within an hour as "not a real question".

I had been hoping to be directed to perhaps a well known and respected book, or perhaps a well known and respected website, or perhaps, an organization's checklist dedicated to such things, or even to an online community like serverfault, or maybe a subreddit.

I was a bit dismayed that my question was closed as vague.

Can you help me formulate a better question that is more appropriate to serverfault and will not be closed as vague and answers the question I have, which is where can I look, what are the best and most up to date sources to learn about securing servers, securing "stacks", and securing web applications?

Thanks.