Some good practices include:
Limiting physical access to the Workflow Manager application server.
Setting up firewalls.
Limiting access to administration capabilities.
Managing passwords.
Limiting the presence of other applications on the server.
Configuring for protected and unprotected servers.
Only specifically identified and controlled administrative and service users should be given a login account email that allows direct UNIX access to the server and then only with the minimum privileges necessary to perform the required tasks.
See these topics: