Advice Request Extra layer needed, or not?

[simmerskool]

New to F-Secure SAFE 18.5, seems solid and light, after 3 days. Wondering if any additional layer is needed, eg, Voodooshield, AppCheck (CheckMal) or AndyFul H_C. I am currently running AppCheck with it, only because it was already installed. Not seeing any impact. None needed? Or other suggestions?

 

[upnorth]

Depends on who you ask or reply really, as some sadly genuine hate and despise ( not healthy for themselves ) anything AV ( antivirus ) related no matter what vendor.

Personal, I would start try to ask you, ask yourself what do you use it for or have wishes or hopes it can and will protect you against. Too many layers is normally for common home users not something I would recommend or advice, but again it depends on what you do online with your machine/system and also what you like to do. One good example on this forum, for people that love to fiddle and test settings/configuration with an AV F-Secure SAFE is probably the wrong choice as it's a set and forget product. It's a " boring " product even if effective when needed.

Another advice that comes to mind would be to start use a SUA ( standard user account ) if you haven't already. It's not AV related, but for sure security related. You then would automatic need less layers.

 

[simmerskool]

Depends on who you ask or reply really, as some sadly genuine hate and despise ( not healthy for themselves ) anything AV ( antivirus ) related no matter what vendor.

Personal, I would start try to ask you, ask yourself what do you use it for or have wishes or hopes it can and will protect you against. Too many layers is normally for common home users not something I would recommend or advice, but again it depends on what you do online with your machine/system and also what you like to do. One good example on this forum, for people that love to fiddle and test settings/configuration with an AV F-Secure SAFE is probably the wrong choice as it's a set and forget product. It's a " boring " product even if effective when needed.

Another advice that comes to mind would be to start use a SUA ( standard user account ) if you haven't already. It's not AV related, but for sure security related. You then would automatic need less layers.

thanks, running as SUA for very very long time. Typically since voodooshield 1.x. I've run VS with every av. Because of ransomware, I'm looking at AppCheck (after I read cruelsister said it was good -- or better than something else) but understand VS covers the ransomware concern. Thinking I don't want to run both AppCheck & VS. I have run H_C but it just seems like I need to take the time to understand it better than I do, but never find the time to do that. Question: is there a "hole" or weakness with F-Secure better covered by one other layer. I'll probably put VS on this pc, but open to ideas. Appreciate your posts!!

 

[upnorth]

Question: is there a "hole" or weakness with F-Secure better covered by one other layer. I'll probably put VS on this pc, but open to ideas. Appreciate your posts!!

An Achilles' heel for all AVs in general would be scripts, but it's not always 100% conclusive because in many of my own tests surprised even myself when DeepGuard in SAFE kicks in. Noted/seen also in the Malware HUB here and not just with F-Secure.

Malware Hub: Samples

Malware samples and tests that are performed by our community members.

malwaretips.com

Good example you mention VS ( Voodoshield ) as it's one of the products we actually done a deep test on in the HUB, and hopefully will do soon again. Personal I lack experience on using it as a combination with SAFE, but I sort of recall others done and can't really remember any specific reports on issues.

 

[Andy Ful]

F-Secure is a top AV, so you probably do not need anything else at home. Most people on MT are sufficiently reasonable and cautious to avoid threats. If you are not sure, then you can add more security layers.
Try to predict if the file will be blocked by additional security layers. If you can make such correct predictions then you can skip additional protection, except if you like it for some other reasons.

 

[simmerskool]

An Achilles' heel for all AVs in general would be scripts, but it's not always 100% conclusive because in many of my own tests surprised even myself when DeepGuard in SAFE kicks in. Noted/seen also in the Malware HUB here and not just with F-Secure.

Malware Hub: Samples

Malware samples and tests that are performed by our community members.

malwaretips.com

Good example you mention VS ( Voodoshield ) as it's one of the products we actually done a deep test on in the HUB, and hopefully will do soon again. Personal I lack experience on using it as a combination with SAFE, but I sort of recall others done and can't really remember any specific reports on issues.

thanks for your your feedback!

 

[upnorth]

thanks for your your feedback!

Thanks for the question. I think it's a smart one because layers ( backups etc ) in general are needed no matter what system or vendors etc one prefer and use, but me side stepping it a little. Wasn't you also using a VM ( virtual machine ) or did I mixed that up with someone else?

 

[simmerskool]

I just reviewed a F-Secure video by Shadowra, and question from Gandalf the Grey, (last month) suggesting H_C was a good 2d layer for F-S. Now to get up to speed with H_C.

re vm. I used to run vmware workstation 15, but then I did an upgrade to something deep and that created an issue, and used none for about 2 years. also busy with something else and rarely visited here. now, YES, workstation 16.2 (paid - ugh) but it runs better than expectations. So sure, in one sense, tweaks on Guest OS is more "testing" than necessity.

F-Secure is a top AV, so you probably do not need anything else at home. Most people on MT are sufficiently reasonable and cautious to avoid threats. If you are not sure, then you can add more security layers.
Try to predict if the file will be blocked by additional security layers. If you can make such correct predictions then you can skip additional protection, except if you like it for some other reasons.

Thanks! I understood Shadowra's recent video test of F-Secure to find small weakness fixed by H_C. I have used H_C in past but did not take the time to understand it deeply enough, my bad. so current plan, when it gets dark tonight, I'll enable H_C again, and attempt to grasp it better. I read what you post, I follow it, sorta, but on a shallow level. Learning is fun. I expect this be a process and not a one-night thing

 

[ForgottenSeer 77194]

If you have a lifetime account of Voodoshield, go all the way with it. It's very powerful. There is a recommended configuration by Danb involving WhitelistCloud to make it trouble free.

 

[mlnevese]

There are some things anyone who is thinking about deploying multi-layered security should think about

1) If you don't know what you are doing, you can render your system unusable. We often see people in forums complaining software x doesn't work on their computers and after some investigation it's discovered that some part of Windows was turned off or blocked by some hardening software. In other words, hardening is good IF you understand what is being done.

2) Most security products are already multi-layered so you may just be adding redundant protection that will do nothing but waste memory and processing cycles. The age of signature only protection is long gone.

3) Your computer use and browsing habits should be considered. If you are not exposing yourself to risk or isn't a high profile target there is no need to go nuclear in system protection .

 

[Andy Ful]

I have used H_C in past but did not take the time to understand it deeply enough, my bad. so current plan, when it gets dark tonight, I'll enable H_C again, and attempt to grasp it better.

You can try H_C if you like. Please start from the Recommended_Settings suggested during the installation of the H_C. This setting profile allows the installation/auto-update of most applications without the need for whitelisting.
For new application installations, use the "Install By SmartScreen" option from the right-click Explorer context menu (choose the application installer and use right-click).
From time to time, you can use <Tools><Blocked Events / Security Logs> to see if something was blocked silently or to identify paths that should be whitelisted.
If you will have questions then post on the H_C thread or make a PM.

 

[simmerskool]

You can try H_C if you like. Please start from the Recommended_Settings suggested during the installation of the H_C. This setting profile allows the installation/auto-update of most applications without the need for whitelisting.
For new application installations, use the "Install By SmartScreen" option from the right-click Explorer context menu (choose the application installer and use right-click).
From time to time, you can use <Tools><Blocked Events / Security Logs> to see if something was blocked silently or to identify paths that should be whitelisted.
If you will have questions then post on the H_C thread or make a PM.

BIG thanks!

 

[poopdookie]

If you have a lifetime account of Voodoshield, go all the way with it. It's very powerful. There is a recommended configuration by Danb involving WhitelistCloud to make it trouble free.

is it still possible to obtain lifetime voodoshield account? edit NM i found it.

 

[Guilhermesene]

Depends on who you ask or reply really, as some sadly genuine hate and despise ( not healthy for themselves ) anything AV ( antivirus ) related no matter what vendor.

Personal, I would start try to ask you, ask yourself what do you use it for or have wishes or hopes it can and will protect you against. Too many layers is normally for common home users not something I would recommend or advice, but again it depends on what you do online with your machine/system and also what you like to do. One good example on this forum, for people that love to fiddle and test settings/configuration with an AV F-Secure SAFE is probably the wrong choice as it's a set and forget product. It's a " boring " product even if effective when needed.

Another advice that comes to mind would be to start use a SUA ( standard user account ) if you haven't already. It's not AV related, but for sure security related. You then would automatic need less layers.

I agree with everything you said @upnorth

For people who like settings and tweaks, I believe that Kaspersky and ESET are ideal products.

I use Kaspersky in default deny mode. Reason? I like to research things here on the Kaspersky forum and community to LEARN (Yes, I said learn, not go around replying without understanding) new things. Also, I've realized that I love reading the documentation (don't ask me why).

But also, I've had times when I'd like something more automatic like Bitdefender, Norton or even F-Secure.

A determining factor also for this is the TIME factor. Why? Because if you want a solution that requires configuration - you'll need time to study what each module does, the importance of each thing in the AV software and the impact it has on the system, test and retest changes to the software. Therefore, all this takes TIME and sometimes we don't have it due to everyday life (work, studies, family etc).

In the end, that's what you said, it all depends on what the person needs

 

[simmerskool]

I agree with everything you said @upnorth

For people who like settings and tweaks, I believe that Kaspersky and ESET are ideal products.

I use Kaspersky in default deny mode. Reason? I like to research things here on the Kaspersky forum and community to LEARN (Yes, I said learn, not go around replying without understanding) new things. Also, I've realized that I love reading the documentation (don't ask me why).

But also, I've had times when I'd like something more automatic like Bitdefender, Norton or even F-Secure.

A determining factor also for this is the TIME factor. Why? Because if you want a solution that requires configuration - you'll need time to study what each module does, the importance of each thing in the AV software and the impact it has on the system, test and retest changes to the software. Therefore, all this takes TIME and sometimes we don't have it due to everyday life (work, studies, family etc).

In the end, that's what you said, it all depends on what the person needs

Agree great points with both Guilhermesene & upnorth. I use ESET on one win10, F-Secure on other. My weakness with H_C is I want to understand it more deeply as it goes to basic operation of windows, but haven't taken the time to learn and understand it better. I hope to correct that this week, as I just (re)enabled H_C on F-Secure pc.

 

[Guilhermesene]

Agree great points with both Guilhermesene & upnorth. I use ESET on one win10, F-Secure on other. My weakness with H_C is I want to understand it more deeply as it goes to basic operation of windows, but haven't taken the time to learn and understand it better. I hope to correct that this week, as I just (re)enabled H_C on F-Secure pc.

Yes, I understand you. I was like that with Kaspersky and the default deny mode. But I decided that it wasn't enough for me to simply "follow a tutorial" if I didn't know how to create my own rules on my own. For that, I needed to study and UNDERSTAND how the program works. I still have a lot to learn, but I've taken MANY, MANY steps before.

I'll give you an example: this tutorial.

It is easy to install the software and implement these rules. But, I ask you: what if I need to create my own rules? What if I want to modify something to my liking? Why did he choose one option and not another? This is just an example, but this is how we started

Everything has its time, take it easy, study, and gradually you will notice that your knowledge is advancing it's a good feeling when we can understand something we wanted so badly

 

[Back3]

I've been using F-Secure Safe for nearly a year now. I like to add another layer of security: I feel more secure. Likewise, I used H_C, Voodooshield and OSArmor is on my PC now. Those 3 pieces of software are maintained by very active developers and are always updated to block the more recent threats.

 

[mlnevese]

System hardening is an excellent protection step but it requires understanding as I mentioned earlier. Let me give a very simple example. It's common that hardening software will stop PowerShell from working, for instance. That's ok if you don't use it for anything but even some very simple tools, such as TCPOptimizer, requires PowerShell to acquire TCP stack information. Also, some of the most powerful Windows maintenance tools require PowerShell.

A common complaint in forums is that some parts of Windows will display a message similar to "this setting has been locked by an administrator/system policy" That is also caused by hardening.

IF you understand what the hardening software is doing, it's amazingly simple to change the setting that is causing you trouble. Otherwise, you'll end up in forums asking for help.

Some other hardening tips, such as do not install Java sometimes is not possible depending on the software you need for your work. I for instance, needed Java installed on my computer up to around 2 years ago because of two different government client software I needed to run on my computers to work. Not having Java installed, simply was not an option. Those tooles still require Java but are now self-contained and do not require a system-wide installation of Java to work just in case you are curious.

So, if you feel your current software is not protective enough and wish to use a layered approach, I recommend you do so, but FIRST understand how the hardening works. There is no "one size fits all" you need to understand what is being done to be sure it will not cause you any unnecessary problem. I'm glad when I see people like @simmerskool and @Guilhermesene saying they took time to understand the tips and instructions before applying. They learned something useful that will avoid them having a lot of trouble in the future.

 

[vtqhtr413]

Also, I've realized that I love reading the documentation (don't ask me why).

I don't think you'll find any bewilderment among this crew

 

[simmerskool]

I've been using F-Secure Safe for nearly a year now. I like to add another layer of security: I feel more secure. Likewise, I used H_C, Voodooshield and OSArmor is on my PC now. Those 3 pieces of software are maintained by very active developers and are always updated to block the more recent threats.

I have used VS for a long time, and have it running on pc with ESET. I have used OSArmor in more distant past. I would have a concern of VS possibly bumping into OSA and visa versa, but that may not be an issue...?