What should I look at when it comes to security on web applications?

Question

I\'m looking at setting up a NodeJS webserver on a GCP compute instance. What should I look into when it comes to security (such as DDOS and other attacks); I\'m not really sure