Advanced Plus Security Geminis3's Security Config 2019

[bayasdev]

Hi guys!

This year I upgrade my laptop to Windows 10 Pro and decided to stick with built-in protection features. Any feedback is welcome.

Thank you!

 

[oldschool]

Looks good to me. Have you applied any OS hardening of any kind?

One suggestion, if you are not already aware of it, is Hard_Configurator. It is a GUI to apply hardening via SRP. It was created and is maintained by @Andy Ful for W10 Home, but you may use it on Pro. You may find it here:

AndyFul/Hard_Configurator

 

[bayasdev]

Looks good to me. Have you applied any OS hardening of any kind?

One suggestion, if you are not already aware of it, is Hard_Configurator. It is a GUI to apply hardening via SRP. It was created and is maintained by @Andy Ful for W10 Home, but you may use it on Pro. You may find it here:

AndyFul/Hard_Configurator

I can't go default deny because I use my laptop for programming but I've tweaked Windows Defender using Group Policy Editor.

 

[LDogg]

So I'd state from this config you only have 2/3 layers of security done, maybe 1 as Macrium Reflect could be a better source of backing up files to that in comparison of Google Drive, but I believe this is merely personal opinion and not fact.

You have a Firewall which is the default from Microsoft, you have a backup solution in the form of GD, however I believe you have inadequate web protection. I'd recommend Scriptsafe & Emsisoft Browser Security for your web browser and maybe twin Windows Defender with Configure Defender or OSArmor/VoodooShield. Most attack areas now revolve around email and web.

Take the advice as you will, thanks for sharing.

~LDogg

 

[bayasdev]

Major changes as of 24/6/2019

• Clean Install 1903
• Replaced WD with Avast Free (minimal install) + WiFi scanner
• Added Windscribe Free VPN

 

[bayasdev]

Update 5/7/2019

Avast was causing me a very strange behaviour when I open a website , first it looks like there's no internet for less than 2 seconds and then the website loads correctly, it didn't happened all time but I prefer to stay 100 KM away from Avast/AVG products.

• Rolled back to a previous non Avast image and installed Bitdefender Free AV

 

[oldschool]

Let us know how it goes with BD. It had some bugs when I used it 6 months ago.

This is kind of funny though: "Default - Settings are balanced for security and performance" since that's all there is to it.

 

[bayasdev]

Let us know how it goes with BD. It had some bugs when I used it 6 months ago.

This is kind of funny though: "Default - Settings are balanced for security and performance" since that's all there is to it.

It started freezing my laptop when I'm on battery so I rolled back and went with Panda Dome Free, I can't even feel that it's running in the background.

 

[bayasdev]

Update
9/7/2019

Removed:

• BD Free (it's still buggy and freezes my device completely )

Added:

• Panda Dome Free (it's extremely light on my system )
• Panda Cloud Cleaner
• BD TrafficLight (to complement the lack of web protection in Dome Free)

Greetings,

 

[Evjl's Rain]

I don't know what your archiver is but please consider using Bandizip or bandizip portable
It will save you from a lot of infections because Panda free is in a weaker sode compared to other well-known AVs

also please consider installing Windows defender browser protection extension for chrome since panda has a virtually useless webfilter

 

[bayasdev]

I don't know what your archiver is but please consider using Bandizip or bandizip portable
It will save you from a lot of infections because Panda free is in a weaker sode compared to other well-known AVs

I always use 7-Zip

also please consider installing Windows defender browser protection extension for chrome since panda has a virtually useless webfilter

BitDefender Traffic Light is way better than WDBP also I use CleanBrowsing DNS.

 

[harlan4096]

@geminis3: You may also pair Panda Dome Free + NVT OSA and/or also add NVT SysHardener mitigations...

 

[stefanos]

Panda free is the weakest antivirus. For light solution you can use Comodo cloud antivirus. Is light like Panda and have very good protection.

 

[bayasdev]

Update
10/7/2019

• Added NVT OS Armor as per @harlan4096 recommendation

Greetings,
geminis3

 

[bayasdev]

Update
14/7/2019

• Replaced Panda Free with F-Secure Safe
• Added F-Secure Browsing Protection Addon

The last time I used F-Secure was when they used BD engine (Aquarius), now with Avira (Capricorn) engine it feels lighter (not as Panda but lighter than BD or WD) also it's DeepGuard (behavior blocker) and Advanced Network Protection makes it a better option over standalone Avira product which only relies on cloud and signatures.

Another thing which I appreciate is that it doesn't snoops on HTTPS connections (like most AVs nowadays). Looks like I'm going to stick with this config a long time

Edit (I forgot to list those changes)

• Removed Panda CloudCleaner, OS Armor
• Replaced 7-zip with Bandizip
• Added ProcessExplorer, AutoRuns,

F-Secure Resource Usage on my laptop

 

[bayasdev]

Update 7/8/2019

• Switched from CleanBrowsing DNS to Quad9 (better performance in my case).
• My router is now running DD-WRT and fowarding DNS queries to a non standard port using built-in dnsmasq, also it removes insecure WPS function and fixes the bufferbloat problem

Greetings,
Geminis3.

 

[bayasdev]

Update 15/10/2019

I reimaged my laptop with Windows 10 LTSC 2019 (based on v1809) so I reworked almost my entire config (check the summary tab )

Some highlights:

• KSC Free as main protection layer
• PatchMyPC Home to install and update software updates automatically
• CCleaner Portable to keep my PC tidy (manual run every month)
• Nano Adblocker + Nano Defender instead of uBlock (it can bypass some anti-adblocking techniques)

PD: I attached a screenshot of my previous config if you want to compare it.

Greetings,
Geminis3

 

[LDogg]

In regards to Nano Defender, the list is already integrated into Nano Adblocker automatically, you are not using the separate extension for this?

~LDogg

 

[bayasdev]

In regards to Nano Defender, the list is already integrated into Nano Adblocker automatically, you are not using the separate extension for this?

~LDogg

I think that Nano Defender is needed to hide Nano Adblocker from websites.

 

[LDogg]

I think that Nano Defender is needed to hide Nano Adblocker from websites.

I think you may have misunderstood my question my friend. Do you have Nano Defender as a separate extension or as a filterlist inside Nano?

~LDogg