Advanced Security Gizmo's PC Config 2025

[Gizmoh]

All of my daily activities are done using a standard user account to further reduce my attack surface. I also make heavy use of virtual machines to do things like random web browsing and software development. This keeps me from polluting my host environment with development tools that could be leveraged against me or exposing myself when visiting potentially untrusted websites.

Please don't hesitate to let me know if you think there is something I could do better.

 

[harlan4096]

I prefer to do a clean OS install instead of restoring from an image. See my comments above about my backup strategy.

But You can restore a critical system in a few minutes, having a full image system backup solution... less time than to install and set up again a new system from scratch.

 

[harlan4096]

Could You explain, what Suricata rulesets are established and enabled?

 

[Gizmoh]

But You can restore a critical system in a few minutes, having a full image system backup solution... less time than to install and set up again a new system from scratch.

After some consideration, I decided it would be a good idea to at least keep a recent system image lying around just in case I do need to recover in a hurry. I chose to use Clonezilla for this task because it is easy to use and suits my personal needs.

Could You explain, what Suricata rulesets are established and enabled?

I currently have Suricata monitoring all three LAN interfaces with the following rulesets applied in blocking mode:

• abuse.ch/Feodo Tracker
• abuse.ch/SSL Fingerprint Blacklist
• abuse.ch/SSL IP Blacklist
• abuse.ch/ThreatFox
• abuse.ch/URLhaus
• ET open/3coresec
• ET open/botcc
• ET open/ciarmy
• ET open/compromised
• ET open/emerging-adware_pup
• ET open/emerging-coinminer
• ET open/emerging-current_events
• ET open/emerging-malware
• ET open/emerging-mobile_malware
• ET open/emerging-phishing
• ET open/emerging-user_agents
• ET open/emerging-worm
• ET open/threatview_CS_c2

These are the following blocklists I am using with Ubound:

• Hagezi's Multi PRO++ - Maximum protection (The name is a little goofy, but it has been a good, well-rounded blocklist)

I do make a conscious effort to avoid lists or rules that are overly aggressive because I don't want to be bogged down with false positives. This configuration works well for my current needs, but like anything else, it will be modified and adjusted over time as my needs change.

 

[Gizmoh]

The Multi PRO++ blocklist has been replaced with the following:

• [hagezi] Multi PRO - Extended protection
• [hagezi] Threat Intelligence Feeds
• [hagezi] Dynamic DNS blocking
• [hagezi] Badware Hoster blocking

I personally feel like these blocklists will provide excellent coverage while also reducing the potential for false positives.