Setup Idea For all those people who post their Security Configurations

[Victor M]

For all those people posting their security configs. If you are interested in testing to see how secure it really is, use an old machine to set it up and put it in your modem's DMZ. What that does is allow full internet access TO your machine, all protocols, all ports. Leave it for a week and then bring it offline and see if there are any problems. We all practice good security hygiene and never download malware, so this test things when things really go awry to see if your security is truly competent.

To see if there are any problems, you can setup Custom Views in Event Viewer. The list of event IDs are listed here: Appendix L - Events to Monitor .

There are several flavors when it comes to hackers. One type slips in and slips out without leaving any traces and don't bother you. They are very difficult to detect, but if you notice a gap in time in your logs then someone has probably erased some logs. The 2nd type notifies you that you've got security problems leaving a note or wallpaper. I got a hacker that sent me local mail on my Linux machine. The 3rd type wrecks your machine or wrecks some functionality so you'd definitely notice.

What you do next is up to you. You can shrug and say you can't stop hackers. Or you can say there is some way that they've got in, so there's a way to stop them. I take the second stance.

I make a drive image when I am done configuring before it ever goes online. (so find that offline AV installer, and pre-download the 2 "cumulative windows 11 x64" patches of the month from Microsoft Update Catalog so you can patch offline, and pre-download the latest MS Defender Intelligence mpam-fe.exe ). Two things are accomplished: a) you can be sure that the machine is absolutely clean and patched before it steps online b) you can re-use that drive image to make improvements without having to start from scratch. And that is a huge time saver because it takes 5 hrs for me to fully harden my machine.

I find it is better to see for myself how secure a setup really is, instead of waiting for @Shadowra to do her video tests. And then, the video tests only 1 or maybe 2 components of your security. These are real life scenarios that no video test can ever capture. The video tests gives you an idea of what to buy, but doing real life testing is where it really counts. Paying $60-$350 for a solution may give you a false sense of security. Sure you got all those knobs and switches to play with, but are they doing anything that really matters?

If at any point you want to leave this game, all you have to do is power off your modem for an hour or two. Then it would fetch a different ip address and no one is going bother you no more. To be extra safe, I have a hardware firewall with IPS Netgate 1100 pfSense+ Security Gateway between my modem and my internal LAN.

 

[Victor M]

Do come back and post your war stories !

 

[Zero Knowledge]

It's obvious your going to get pwned with your setup idea. You may catch the low hanging fruit but the advanced stuff which we all worry about and try to protect ourselves against will no doubt delete or manipulate event viewer files/log files to hide their persistence. These days you just have to assume you are PWNED and you are COMPROMISED by someone/somewhere.

One caveat is if your into crypto then you should be very worried, you will be attacked. If your not into crypto your much better off since you don't have a target on your back.

And I'm sure most people do most of their sensitive communications/business on Android/iOS which have much better security controls and update cycles and protection than Windows.

 

[bazang]

It's obvious your going to get pwned with your setup idea.

Very much doubtful, even if it is possible technically.

One caveat is if your into crypto then you should be very worried, you will be attacked. If your not into crypto your much better off since you don't have a target on your back.

The reason cryptobros and cryptogirlz and crypto-we-don't-know-what-you-are are pwned is because they are prolific downloaders and/or they conduct their crypto activities as real, easily identifiable people and easily tracked and/or they are easily manipulated by email campaigns.

You may catch the low hanging fruit but the advanced stuff which we all worry about and try to protect ourselves against will no doubt delete or manipulate event viewer files/log files to hide their persistence. These days you just have to assume you are PWNED and you are COMPROMISED by someone/somewhere.

Unless some home user is an enemy of the state, they should spend their time & effort on seeing a therapist instead of 5 or more hours hardening their systems. A few simple steps will protect them against everything except Windows network stack exploits that lead to malicious code running in the Windows kernel - which is true pwn.

The only group of people I know who are actively targeted for their digital activities are Uyghurs who receive international calls. Just that call sends them and their families to prison and hard labor camps. Others are journalists (based in many countries) that are just plain stupid because they know what is going to happen to them and their families, and yet they do it anyways.

 

[Zero Knowledge]

Your assumptions are wrong. You don't know what data or information hackers have in their possession or how they would target people of interest or what makes you a target in the first place.

EternalBlue would still work today if the Shadow Brokers had not gone full disclosure. You have to believe that there are many other similar exploits collected and used by state governments.

And cryptobro's and crptogirlz would be the least likely to download cracks and pirated software. You don't know what exchanges have been breached or what surveillance, recon and information attackers have.

In the end do what you want, but don't believe or snort the magical fairy dust that everything is 'A-OK' with bog standard Windows out of the box. Windows is the reason we have a security industry and forums like this one exist because Windows is inherently insecure without tweaking and security software. Your telling me that a home user can just leave a Windows machine on the open internet and expect nothing to happen if your a target? You do understand governments and criminals have incredibly intelligent people working in teams of 10 to 100's who's job it is full time to penetrate and compromise networks and you will just be fine? Please....

Yes too much paranoia is bad but there is no excuse in being naive and ignorant about the security landscape.

 

[Victor M]

A few simple steps will protect them against everything except Windows network stack exploits

Enlighten me please.

 

[bazang]

Enlighten me please.

It is called "Least Privilege" and "Least Functionality" and published in the US's NIST SP 800-53R4 and R5.

Windows is not shipped in a form that is intended by Microsoft for users to allow everything enabled. But Microsoft does not want to be bothered with home users so it ships a default Windows for Home configuration intended to allow "dumb and stupid users that want to use stuff" to do most anything that they want.

Microsoft's position - along with every other software publisher's position - is that all users, regardless of their knowledge, awareness, and abilities - are responsible for their actions using their software. Read their EULAs. In short, the user is always the problem. ALWAYS.

It should take no more than 60 minutes to fully lock down any Windows system - locking the user out from shooting themselves in the foot or their progeny or other family members or friends from doing the same. For those uneducated people living in rural villages, whom can neither read nor write, and should not be given digital devices - well, there is no helping them.

 

[bazang]

Your assumptions are wrong. You don't know what data or information hackers have in their possession or how they would target people of interest or what makes you a target in the first place.

EternalBlue would still work today if the Shadow Brokers had not gone full disclosure. You have to believe that there are many other similar exploits collected and used by state governments.

And cryptobro's and crptogirlz would be the least likely to download cracks and pirated software. You don't know what exchanges have been breached or what surveillance, recon and information attackers have.

In the end do what you want, but don't believe or snort the magical fairy dust that everything is 'A-OK' with bog standard Windows out of the box. Windows is the reason we have a security industry and forums like this one exist because Windows is inherently insecure without tweaking and security software. Your telling me that a home user can just leave a Windows machine on the open internet and expect nothing to happen if your a target? You do understand governments and criminals have incredibly intelligent people working in teams of 10 to 100's who's job it is full time to penetrate and compromise networks and you will just be fine? Please....

Yes too much paranoia is bad but there is no excuse in being naive and ignorant about the security landscape.

You can worry about lightning strikes, but it is not helpful to others. You are a paranoid.

I know all about what hackers use to target, and targeting individual home users is an obsolete worry. If you happen to be a cryptowhale and advertise yo sheet all over social media, and then find you are targeted, well then you are stupid. You got what you deserved.

Typical crypto participants lose because they are prolific downloaders and they respond to phishing emails. Crypto participants are notoriously not security conscious. They use unvetted, unchecked software and get themselves into trouble. The demographic of crypt bros and girls and "others" are those least likely to practice robust security.

You do realize all of this is publishes in goverment and academic studies, right? (Do your research. Don't ask for links.)

Please don't spread your paranoia. It only make the paranoid more mentally ill.

 

[Victor M]

@bazang. Yes I know what least privilege is.

In addition to using a standard user account, I remove rights for that account to run powershell, regedit, reg, and schtask plus a few more things.

But least privilege is not enough. Attackers have privilege escalation tricks and exploits.

For Least Functionality, I disable certain services, turn off remote <anything>, turn off network protocols, uninstall apps, firewall known MS telemetry ip's, turn off various Start>Settings>Privacy&Security, and so on.

I think the 5 hrs is mostly due to inefficiency, I was doing gpedits by hand instead of backing up and restoring. And chatgpt introduced a way to backup and restore Start>Settings partially. I estimate those 2 things should eliminate ~2 hrs. Creating cip files takes 45 mins; which can be backed up and restored instead. Installing various apps takes 1 hr which actually shouldn't be included in the total because it is not hardening. Pretty close to your 1 hr benchmark. And for the rest of the stuff mentioned above I already have scripts made. Still, if you don't mind sharing your insights, I would like to hear them, if it is not a trade secret.

I keep putting off reading 800-53 - too many bracketed role names, interferes with reading. I follow PCI-DSS.

 

[Vitali Ortzi]

It is called "Least Privilege" and "Least Functionality" and published in the US's NIST SP 800-53R4 and R5.

Windows is not shipped in a form that is intended by Microsoft for users to allow everything enabled. But Microsoft does not want to be bothered with home users so it ships a default Windows for Home configuration intended to allow "dumb and stupid users that want to use stuff" to do most anything that they want.

Microsoft's position - along with every other software publisher's position - is that all users, regardless of their knowledge, awareness, and abilities - are responsible for their actions using their software. Read their EULAs. In short, the user is always the problem. ALWAYS.

It should take no more than 60 minutes to fully lock down any Windows system - locking the user out from shooting themselves in the foot or their progeny or other family members or friends from doing the same. For those uneducated people living in rural villages, whom can neither read nor write, and should not be given digital devices - well, there is no helping them.

It's not that Microsoft isn't trying too it probably will virtualize more and restrict more stuff in windows 12 but the thing is it can't do much as either people can't use almost anything like in windows s mode or they have too many privileges and install malware and even if Microsoft locked everything attackers are already moving more to pishing and other methods as they are more efficient

 

[Zero Knowledge]

Typical crypto participants lose because they are prolific downloaders and they respond to phishing emails. Crypto participants are notoriously not security conscious. They use unvetted, unchecked software and get themselves into trouble. The demographic of crypt bros and girls and "others" are those least likely to practice robust security.

Maybe it's a generational thing since I'm getting older by the day but I've found crypto bros and girls from my era are very security conscious and practice very good computer security & hygiene. You can call them 'privacy freaks' or 'paranoid' but they are oldskool cyberpunks who know their software and know hacking trends, so I disagree with your point that all crypto people are terrible at security and download pirated material and click on every phishing email.

Note: Phishing is different my friend to Downloading cracks and warez.Everyone is effected by phishing.

 

[Victor M]

It's obvious your going to get pwned with your setup idea.

You don't know what data or information hackers have in their possession

You are a spoilsport, you yourself says nobody knows what the hackers know. I think you are overestimating their capabilities.

On the other hand I overestimate the effects of good secure-configuration.

 

[Zero Knowledge]

You are a spoilsport, you yourself says nobody knows what the hackers know. I think you are overestimating their capabilities.

On the other hand I overestimate the effects of good secure-configuration.

Your right I do overestimate what hackers know. But I've received a fair amount of breach emails from Have I Been Pwned: Check if your email has been compromised in a data breach and you can only assume it's a fraction of what's been compromised. Cyber crooks are one thing, their motive is pure financial but nation states is another matter entirely. You never know in the future you are in some foreign country even on a flight layover and information from your compromised accounts could come back to bite you.