Advanced Plus Security joyous home PC Config 2020

[Brahman]

I am extremely thankful @ Vitali-ortzi for suggesting me SEP and also for helping me out with configuration of SEP manager. I Use admin Account since no one else uses this pc.

 

[Vitali Ortzi]

I am extremely thankful @ Vitali-ortzi for suggesting me SEP and also for helping me out with configuration of SEP manager. I Use admin Account since no one else uses this pc.

Let's start by this is not your average security Configuration.
Rather one of the best Configuration in this forum!

I'm very proud that you decided to set up quality policies even including Deception(honeypots).

If I was an attacker I would ##### my pants right now .

About improvements,
no way it's minor changes for increased security.
Change it to major.
And make an exclusion to your programs (fingerprint hash).

import rules from H_C firewall hardening as well in case you haven't already.
Set client control if some options are presented in a gray color in SEP client GUI.

Anyway I hope you upload a few screenshots of your policies In case someone is interested.

 

[harlan4096]

@JoyousBudweiser: you may set UAC to Always Notify, thanks for sharing...

 

[Brahman]

Some of my settings.

 

[Brahman]

And make an exclusion to your programs (fingerprint hash).

If I make a fingerprint list using "checksum.exe" and import the same to sepm for whitelisting in system lock-down, upon updating an app say chrome.exe, will the fingerprint of that app change? if it changes, do i need to redo the whole fingerprinting again and import it....

 

[Vitali Ortzi]

If I make a fingerprint list using "checksum.exe" and import the same to sepm for whitelisting in system lock-down, upon updating an app say chrome.exe, will the fingerprint of that app change? if it changes, do i need to redo the whole fingerprinting again and import it....

Any modifications to an application /file changes the hash .
System lockdown is to aggressive for almost any kind of usage.
I personally use it only in office /banking exclusive computers .
In case you want system lockdown watch this first
And always set test mode for two weeks only then production in any policies change you make .

 

[Vitali Ortzi]

Any modifications to an application /file changes the hash .
System lockdown is to aggressive for almost any kind of usage.
I personally use it only in office /banking exclusive computers .
In case you want system lockdown watch this first
And always set test mode for two weeks only then production in any policies change you make .

And yes I'm sorry if the so called "premium support" of the leading company in the industry .
Has a ##### microphone and mediocre explaination.

 

[Brahman]

Any modifications to an application /file changes the hash .

Okay...then its a time consuming process every time an application gets updated, the idea gets dropped then ( something gets always updated in my system every day). Thanks.

 

[Vitali Ortzi]

Okay...then its a time consuming process every time an application gets updated, the idea gets dropped then. Thanks.

It was built for ATM , embedded devices , or any device that doesn't require modifications in an application /software every few days .

 

[Vitali Ortzi]

Basically you need SEP hardening /isolation for your use case unfortunately it requires Cloud access and it's an added very expansive subscription(not possible).

 

[Brahman]

Edit:
1. User access Control changed to " always notify"
2. added "WPD" to control windows privacy settings.

 

[Vitali Ortzi]

Why does this PC have only one stick of ram ?
Dual channel has best performance.

 

[Brahman]

Why does this PC have only one stick of ram ?
Dual channel has best performance.

Ya I know, Financial trouble my brother... at the time of buying. I spend a lot of money on presonus eris 4.5 powered bookshelf speakers and also on an 8" Blaupunkt Sub-woofers ( I don't repent on both). I thought i shall add one more stick when i have the extra money to spare ( but time now have changed, this corona thing had caused memory prices to skyrocket. Everything is 40 to 50% pricier. I am waiting for the prices to drop to some sane levels)

 

[Vitali Ortzi]

I understand .
BTW this is a good place for cheap prices.

Reddit - Dive into anything

www.reddit.com

 

[Brahman]

edit:
Added Malwarebytes browser guard. ( almost blocks all the links in PhishTank > Phish Search )

 

[Nagisa]

Hey, I think that the 'Download insight' feature is useless (at such a high level), unless you are sharing your computer with somebody who are a happy clicker. At higher settings, all it does is moving less reputable files to quarantine automatically. At lower settings, you decide yourself wheter you want to keep that file or not. Kind of like dynamic lockdown.

 

[Vitali Ortzi]

Hey, I think that the 'Download insight' feature is useless (at such a high level), unless you are sharing your computer with somebody who are a happy clicker. At higher settings, all it does is moving less reputable files to quarantine automatically. At lower settings, you decide yourself wheter you want to keep that file or not. Kind of like dynamic lockdown.

It's fine as long as he downloads only very popular software.

 

[Nagisa]

It's fine as long as he downloads only very popular software.

yeah ofc. As i said, it’s kind of like lockdown. He won’t get interrupted (unknown file being deleted) as long as he uses popular and safe software.

 

[Brahman]

Hey, I think that the 'Download insight' feature is useless (at such a high level), unless you are sharing your computer with somebody who are a happy clicker. At higher settings, all it does is moving less reputable files to quarantine automatically. At lower settings, you decide yourself wheter you want to keep that file or not. Kind of like dynamic lockdown.

Till now it hasn't quarantined anything in my pc except an eicar test file. I am keeping it as a test run to see how does it performs....

 

[Brahman]

Edit:
1. Added Firefox with DOH, enabled Encrypted SNI with cloudflare DNS.
2. Enabled DOH in all chromium based browsers.
3. System dns changed to cloudflare's DNS.