Very minimal security configuration that takes up 1% of CPU while idle and less than 50MB of RAM. Layered defense using software and built-in Windows security hardening.
Network Protection Layers
----
Windows Firewall set to block all incoming connections regardless of whitelisting.
Webroot Firewall set to block all unknown connections.
DNSCrypt with OpenDNS
Web Protection Layers
----
Webroot Web Filtering (Blocks 96% of all phishing attempts, very powerful, but lackluster malware detection.)
uBlock Origin Filters (Blocks all malvertising attempts, some malware links.)
Google Safe Browsing (Blocks some malware and phishing attacks, last resort, not very effective.)
OpenDNS phishing and malware protection.
File Protection Layers
----
Webroot SecureAnywhere AntiVirus (Good malware detection, rollback features, usually not intrusive.)
SBGuard AntiRansomware (Blocks all non-administrative executables everywhere except on Desktop and external drivers, very powerful and prevents malware from running that Webroot doesn't catch.)
chml.exe (Permissions tool used to set integrity levels. Configured properly, it stops most applications from modifying or reading any files in Documents, Music, Videos, or Pictures. Stops spyware and some Ransomware.)
Endpoint Protection Layers
----
Password-protected local account (locks out after every 5 attempts for 5 minutes.)
Bitlocker w/ 256-bit XTS AES encryption.
Prey Anti-Theft
A fake local account named "Admin" that when logged in makes a lot of hilarious alarms. Effective, but also hilarious.
Recovery Protection Layers
----
Windows 10 built-in File History
System Restore
Backups to Sync.com encrypted with Cryptomator
And a variety of windows tweaks that disables WHS, ipv6, UPnP, DCOM, and other attack surfaces. Unnecessary drivers are disabled, and Bitlocker is enabled with 256-bit XTS AES encryption for Endpoint protection. Using this configuration I have thrown a ton of malware links at it and it has effectively blocked all of them, and about 99% of phishing links pulled from PhishTank. It has also blocked all ransomware according to RanSim. Although these are synthetic tests, I am quite confident that it holds up very well in a real-world scenario. Most attacks through the browser simply will not work, and any executable that does get through either will not run or not have enough permissions to modify the system. It is in effect a lightweight fort KNOX.
Network Protection Layers
----
Windows Firewall set to block all incoming connections regardless of whitelisting.
Webroot Firewall set to block all unknown connections.
DNSCrypt with OpenDNS
Web Protection Layers
----
Webroot Web Filtering (Blocks 96% of all phishing attempts, very powerful, but lackluster malware detection.)
uBlock Origin Filters (Blocks all malvertising attempts, some malware links.)
Google Safe Browsing (Blocks some malware and phishing attacks, last resort, not very effective.)
OpenDNS phishing and malware protection.
File Protection Layers
----
Webroot SecureAnywhere AntiVirus (Good malware detection, rollback features, usually not intrusive.)
SBGuard AntiRansomware (Blocks all non-administrative executables everywhere except on Desktop and external drivers, very powerful and prevents malware from running that Webroot doesn't catch.)
chml.exe (Permissions tool used to set integrity levels. Configured properly, it stops most applications from modifying or reading any files in Documents, Music, Videos, or Pictures. Stops spyware and some Ransomware.)
Endpoint Protection Layers
----
Password-protected local account (locks out after every 5 attempts for 5 minutes.)
Bitlocker w/ 256-bit XTS AES encryption.
Prey Anti-Theft
A fake local account named "Admin" that when logged in makes a lot of hilarious alarms. Effective, but also hilarious.
Recovery Protection Layers
----
Windows 10 built-in File History
System Restore
Backups to Sync.com encrypted with Cryptomator
And a variety of windows tweaks that disables WHS, ipv6, UPnP, DCOM, and other attack surfaces. Unnecessary drivers are disabled, and Bitlocker is enabled with 256-bit XTS AES encryption for Endpoint protection. Using this configuration I have thrown a ton of malware links at it and it has effectively blocked all of them, and about 99% of phishing links pulled from PhishTank. It has also blocked all ransomware according to RanSim. Although these are synthetic tests, I am quite confident that it holds up very well in a real-world scenario. Most attacks through the browser simply will not work, and any executable that does get through either will not run or not have enough permissions to modify the system. It is in effect a lightweight fort KNOX.
