Q:

Is Ubuntu security enough? 

I work with sensible data, so I need a reasonable level of security and use Ubuntu as main operative system in a professional activity. 
I have developed a php platform that performs some sensible operations with AES and RSA, so I need to have a local web server. 
Does it break system security?  Which fixes may I apply? 
And, more in general, are Ubuntu default setting safe enough? 

A:

If you are classifying your system as a high-value asset, I would say the defaults are not sufficient.  I would recommend downloading and reading the CIS benchmarks for Debian and Apache and implementing the hardening recommendations.  More specifically out of the box 'root' logins are permitted with SSH server which is truly stupid.  Attached is a link to the site where you can download them.  
http://benchmarks.cisecurity.org/en-us/?route=downloads.benchmarks

