Hello!

[BJ Security]

Hello! My name is BJ Security. I am new to cybersecurity. I am from the Philippines. I hope this forum would help me understand how Antiviruses work, how to protect myself from internet threats, how to setup a good privacy settings for any browsers, and how to completely secure an account. My google account is secured with "Advanced Protection Program", in case, someone can't gain access.

For me, I setup a good privacy settings on chrome.
I do not do anything dumb in the internet.
I do not pirate anything in the internet instead, stay away from:

- Questionable websites
- Sketchy websites
- Pirated websites
- Torrent websites


Additionally:

- I do not ever click on any malicious links or attachments
- I do not ever download any Archives (cause it could be an Infostealer)
- I do not ever click on the "Blue highlighted" texts (these is where hidden links hides that redirect you to random, malicious or phishing page)


All what I'm doing, is watching on Youtube about how effective most AVs can protect against threats, what will happen if any major threats (like ransomware or infostealer) have been executed in the VM, how do I protect myself from these terrible threats, what security tools should I use, what malware analysis would recommend as a cybersecurity, etc.

I also read most articles from:

- Forbes
- BleepingComputer
- Others

I do have web tools (like Virustotal, Bitwarden, ScamAdviser, etc.).

Anyway, the only thing I can protect my pc from threats, is Windows Defender w/ DefenderUI Pro (set to "Aggressive Profile", everything enabled, and WDAC Enforced) and use common sense.

 

[Jonny Quest]

Hello, and welcome to the forum @BJ Security

 

[harlan4096]

Welcome to MWTips, and thanks for joining ! Hope You enjoy our community !

Feel free to read the forum rules: Forum Rules

 

[Shadowra]

Welcome

 

[Victor M]

Welcome to MT !!

 

[Digmor Crusher]

Kumusta, welcome.

 

[McLovin]

Welcome to MalwareTips!

 

[Dave Russo]

Greetings to a great site with great people

 

[Viking]

Hello and welcome to MalwareTips!

 

[Victor M]

Hello! My name is BJ Security. I am new to cybersecurity. I am from the Philippines. I hope this forum would help me understand how Antiviruses work, how to protect myself from internet threats, how to setup a good privacy settings for any browsers, and how to completely secure an account. My google account is secured with "Advanced Protection Program", in case, someone can't gain access.

For me, I setup a good privacy settings on chrome.
I do not do anything dumb in the internet.
I do not pirate anything in the internet instead, stay away from:

- Questionable websites
- Sketchy websites
- Pirated websites
- Torrent websites


Additionally:

- I do not ever click on any malicious links or attachments
- I do not ever download any Archives (cause it could be an Infostealer)
- I do not ever click on the "Blue highlighted" texts (these is where hidden links hides that redirect you to random, malicious or phishing page)


All what I'm doing, is watching on Youtube about how effective most AVs can protect against threats, what will happen if any major threats (like ransomware or infostealer) have been executed in the VM, how do I protect myself from these terrible threats, what security tools should I use, what malware analysis would recommend as a cybersecurity, etc.

I also read most articles from:

- Forbes
- BleepingComputer
- Others

I do have web tools (like Virustotal, Bitwarden, ScamAdviser, etc.).

Anyway, the only thing I can protect my pc from threats, is Windows Defender w/ DefenderUI Pro (set to "Aggressive Profile", everything enabled, and WDAC Enforced) and use common sense.

First of all I want you to expand your view of what cybersecurity is composed of. There are 3 categories of protection: Administrative, Technical and Physical.

Administrative: (manual) eg. Not opening attachments, disconnecting the internet when connecting to NAS to do backups, doing vulnerability scans, signing out when done with a web app to combat infostealers. These are manual things you do, and they are classiifed as Administrative controls.

Technical: Antivirus, Intrusion Protection like Suricata and Snort, firewall, EDR, SIEM are Technical controls.

Physical: Locks on the office door, burglar alarms, security guards are examples of Physical controls catagory.

In order to have Defense in Depth ( a security principle) you need to have controls that span all 3 catagories. And you need to have more than 1 kind of each catagory. For example, an antivirus alone in the technical catagory is not enough, because it may fail. AV's fail all the time when it comes to Zero Days and hackers. So antivurus suites come with behavioral detection and some also come with Host Intrusion Detection/Prevention, as an example. Setup an EDR. The firewall rules that comes with Windiows is weak, so you need to improve it's rules. Your browsers need compartmentalization protection; use Sandboxie.

The next thing I'll borrow from NIST. First you try to Protect, if they should fail, you must be able to Detect. Hence the EDR (endpoint detection & response), and SIEM (security information & event management) With these 2 kinds of tools, you get to specify things to watch out for, and they give the visibility to see them as they happen. (for example when some program is added to the AutoRuns registry, why did the AV not detect it? Maybe it was done via a LoLBin.) Many companies have both. The SIEM collects logs from everything: PC event logs, firewall logs, logs from the router and switches, IPS logs; you name it. And it ties them together and Alerts you on things that are happening. Perhaps your AV missed detecting a scheduled task inserted by a hacker that does something nasty. You need visibility into all your inventory of devices to see an attack taking shape or spreading. If you don't have these 2, you will have to manually inspect logs yourself: Event Viewer custom views, AV logs, hardware firewall and Windows firewall logs, etc, and tie them together.

So the videos you watch shows you how a malware bypassed this and that AV, well, do something about it: disable features that were attacked that you don't need, setup detection scripts, configure your EDR's detection. Protect and Detect, gotta have both to do cybersecurity.

There, I have crammed all the need-to-know basics into your head. I hope I wasn't repeating things you know.

 

[piquiteco]

Hi, @BJ Security Good browsing habits, that's good. By the way Welcome to MalwareTips!