Security setup
PC setupWindows 10
Marana's PC Security Config
Layout
Imported from an earlier discussion · awaiting owner confirmation
Community rating0 member ratingsStaff assessment
Advanced Plus Security
Earlier staff assessment. The reviewer, date and configuration version were not recorded. It has not been verified against the current Hub setup.
Device & operating system1
- Operating system
- Windows 10
Protection & updates11
- Real-time protection
- Windows Defender
Malwarebytes Windows Firewall Control (WFC)
Comodo Firewall
NovirusThanks OSArmor
G DATA USB Keyboard Guard
ConfigureDefender
FirewallHardening - Device firewall
- Other - Next-generation Firewall (NGFW)
- Security updates
- Allow security updates
- Update channels
- Allow stable updates only
- User Account Control (UAC)
- Always notify
- Network firewall
- Enabled
- Router and network details
- WiFi by Ubiquiti Unify APs.
Routing, Radius Server and Edge Firewall by pfSense firewall appliance.
Separate VLANs for Home, TV, IoT and Guest use (both wired & wireless).
Home VLAN protected by 802.1X (EAP-TLS) and device certificates. Self-created Root CA. - Custom security settings
- Custom firewall & routing configuration in edge firewall (pfSense appliance)
Outbound network connections blocked by default in Windows Defender Firewall (WFC)
Modified Cruelsister configuration in Comodo Firewall
Modified Microsoft Security baseline for Windows 10 v1809 (I’m using Windows 10 LTSC 2019)
Modified Microsoft Office 2016 Security baseline
Several Windows features turned off
Several Windows services disabled
Some Windows registry tweaks
Some ACL based directory hardenings
Exploit protection enabled for Microsoft Office programs, browsers etc.
Software Restriction Policies (SRP) enabled. Default Deny. Enforcement for all files.
ConfigureDefender in HIGH settings
FirewallHardening with Recommended H_C + LOLBins
BitLocker with dTPM enbled for all relevant internal & external disk partitions - Periodic malware scanners
- Emsisoft EEK
Norton NPE - Malware sample testing
- I do not participate in malware testing
- Environment for malware testing
- N/A
Browser & privacy4
- Browsers and extensions
- Brave as main browser. Three user profiles (Network surfing / Banking & online shopping / Ad hoc & test use)
- Microsoft Defender Browser Protection
- Cookie AutoDelete
Microsoft Edge installed, but not actively used nowadays - Secure DNS
- Quad9
- Desktop VPN
- Proton VPN
- Password and passkey manager
- KeePass
Backup & recovery2
- File and photo backups
- Macrium Reflect Workstation
SecondCopy - System recovery
- Macrium Reflect Workstation. GFS-type backups with stepwise decreasing granularity in redundancy. AES-256 encryption enabled for backup files.
Fortnightly semiautomatic backup replication alternating to two external disks stored in remote locations
Annual long-term backups in a third external disk. Includes PAR2 parity archives (“Parchive”) with 1% redundancy to protect backups from latent sector errors and with a simple EMP shield to protect from Carrington events as well as from tactical nuclear bomb EMPs (however not does not protect from the upcoming apocalypse
). Disk stored in a burglarproof and fireproof safe.
Device & usage3
- Main use of this computer
- For home and private use
- Maintenance tools
- Hard Disk Sentinel Enterprise
Active@Partition Manager
Hex Editor Neo
FileVerifier++
DiskSavvy
WinMerge
Autoruns, Process Explorer, Process Monitor, Process Hacker, PsExec
accesschk, icacls
HardWipe
Self-made nightly script for automatically cleaning temporary files - Computer specs
- Motherboard: ASUS AMD X570
CPU: AMD Ryzen 5 3600
GPU: ASUS GeForce GTX 1060-O3G
RAM: 32 GB DDR4
Storage:
- 2 x 1 TB SSD
- 1 x 8 TB HDD
- 1 x 4 TB HDD
- 1 x 256 GB SSD
Shared by the member. This is a configuration record, not a device scan.
Comments and feedback belong in the forum discussion. Open it to join the conversation.