Advanced Security AMD1's PC Security Config

[AMD1]

Hi,

My security setup for 2022 onwards.

Open for any comments/suggestions.

Thanks

Andy

 

[blackice]

Malwarebytes Browser Guard may be a bit redundant with the F-Secure extension installed.

 

[AMD1]

Thanks,

I wasn't sure as the F-Secure extension sits very quietly in the background but the Malwarebytes Browser Guard has a count of items blocked.

Have removed Malwarebytes Browser Guard for now.

 

[silversurfer]

Thanks,

I wasn't sure as the F-Secure extension sits very quietly in the background but the Malwarebytes Browser Guard has a count of items blocked.

Have removed Malwarebytes Browser Guard for now.

Just to inform, Malwarebytes Browser Guard counts even for blocked ads, so that's probably the main reason why it shows more "activity..."

Browser Guard: 100% free ad blocker browser extension

Malwarebytes Browser Guard for Chrome, Firefox, Safari and Edge helps protect your online privacy from ad trackers and more.

www.malwarebytes.com

 

[AMD1]

Just to inform, Malwarebytes Browser Guard counts even for blocked ads, so that's probably the main reason why it shows more "activity..."

Browser Guard: 100% free ad blocker browser extension

Malwarebytes Browser Guard for Chrome, Firefox, Safari and Edge helps protect your online privacy from ad trackers and more.

www.malwarebytes.com

Thanks that makes sense. It was just the F-Secure extension seems so quiet which is a good thing in a way.

 

[AMD1]

One thing I am not sure of with F-Secure SAFE is the protection it provides for incoming emails and attachments, spam etc (not email address monitoring). With other products I have had these have had an Outlook add-in and something to manage good/spam email.

Presumably F-Secure is monitoring email activity but just does not have a spam filtering/logging facility ?

Comments appreciated thanks.

 

[AMD1]

Possibly looking to add one or a combination of Windows Firewall Control, Simple Windows Hardening and O&O ShutUp ?

Are any of the above overlapping with current set-up ?

 

[Kongo]

Possibly looking to add one or a combination of Windows Firewall Control, Simple Windows Hardening and O&O ShutUp ?

Is this overkill with current set-up ?

I'd choose either VoodooShield or Simple Windows Hardening.

F-Secure + Simple Windows Hardening + Windows Firewall Control seems like a nice combination to me. F-Secure has good signatures for PE-files as it is using Avira engine. Sadly the Avira engine is quite weak at detecting scripting malware, so Simple Windows Hardening is a nice addition in my opinion.

So it's up to you, but SWH + VoodooShield is overkill in my opinion and doesn't add any major value to your config.

 

[AMD1]

I already have VoodooShield Pro running so I think I will stick with that.

Would WFC add much over the build it Windows Defender Firewall do you think ? I have never had a separate Firewall Program before as previously i have picked software suites with firewall protection built in.

 

[ForgottenSeer 94633]

I would choose VoodooShield.

 

[Kongo]

I already have VoodooShield Pro running so I think I will stick with that.

Would WFC add much over the build it Windows Defender Firewall do you think ? I have never had a separate Firewall Program before as previously i have picked software suites with firewall protection built in.

I never really used WFC, I always used Firewall Hardening which is from the same developer as Simple Windows Hardening:

FirewallHardening tool | MalwareTips

FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone...

malwaretips.com

 

[AMD1]

Just so I know,If I were to install Firewall Hardening and later uninstall it, do the firewall settings revert back to the default rules of the Windows Firewall ?

 

[Kongo]

Just so I know,If I were to install Firewall Hardening and later uninstall it, do the firewall settings revert back to the default rules of the Windows Firewall ?

It's portable so you don't have to install or uninstall anything.

When you launch the tool for the first time, there won't be any rules added. You can choose which ones you want to add on the right side. When you want to remove the rules again, you just need to click on the remove buttons:

Spoiler: Remove buttons

In case you want to check wether the rules are applied, you can always proceed like this:

1. Access the Windows Security Center
2. Click on the Firewall tab
3. Click on advanced settings
4. Click on outbound rules
5. There you should see all the rules created by Firewall Hardening:

Spoiler: Firewall Rules

 

[AMD1]

Thanks SecureKongo

I may well give the stand-alone version a try and see how I get on with it then. I just didn’t want to get myself in a mess but this looks fairly straightforward - I hope !

 

[AMD1]

I have Firewall Hardening on my PC now and have added Recommended H_C. Does recommended incorporate LOLBins and MS Office or do you add these separately as required ?

 

[Kongo]

I have Firewall Hardening on my PC now and have added Recommended H_C. Does recommended incorporate LOLBins and MS Office or do you add these separately as required ?

Better read all the information that is provided in the thread I sent you.

Here a short abstract:

The user can add/remove some predefined rules: 'LOLBins', 'MS Office', 'Adobe Acrobat Reader', 'Recommended H_C'. They are visible on the right of the application GUI.

« 'LOLBins' rules are related to Living Of The Land executables from system folders, which are known to be commonly abused by malc0ders.

« 'MS Office' and 'Adobe Acrobat Reader' rules are related to Word, Excel, PowerPoint, Equation Editor, and Acrobat Reader applications.

« 'Recommended H_C' is a part of 'LOLBins’. These rules are suited to users who installed the Hard_Configurator Windows hardening application and applied the <Recommended Settings>.

As you don't have Hard_Configurator installed, you should probably use the LOLBins rules. If you have any Microsoft Office software like Word or Excel installed, you can add the MS Office rules too. And if you are using Acrobat Reader, you can add those rules as well.

 

[AMD1]

Thanks

I had a read of that thread but still wasn't sure after reading it !

 

[Kongo]

Thanks

I had a read of that thread but still wasn't sure after reading it !

No problem! if you still have any questions, just ask. I am pretty sure that you won't face any issues tho. After applying the rules you probably won't even notice any difference.

One thing though... I'd recommend enabling the logging feature, so that you can check what's blocked.

 

[AMD1]

No problem! if you still have any questions, just ask. I am pretty sure that you won't face any issues tho. After applying the rules you probably won't even notice any difference.

One thing though... I'd recommend enabling the logging feature, so that you can check what's blocked.

Thanks and yes I spotted the logging feature and enabled it.

I have added LOLBins and MS Office

 

[AMD1]

My current config.

Comments welcomed.