- Feb 25, 2017
- 2,585
Kongo's Computer Security Config 2024
- Thread starter Kongo
- Start date
- Last updated
- Jul 17, 2024
- How it's used?
- For home and private use
- Operating system
- macOS 15 Sequoia
- On-device encryption
- BitLocker Device Encryption for Windows
- Log-in security
-
- Hardware security key
- Security updates
- Allow security updates and latest features
- Update channels
- Allow stable updates only
- User Access Control
- Always notify
- Smart App Control
- Off
- Network firewall
- Enabled
- About WiFi router
-
- Speedport Smart 4
- Firewalla Blue +
- Real-time security
-
Deep Instinct Endpoint Protection
WhitelistCloud
- Firewall security
- Microsoft Defender Firewall with Advanced Security
- About custom security
-
Hardening tools:
- Firewall Hardening (blocking outbound connections of LOLBins)
- Run by SmartScreen (forces SmartScreen to scan files of choice)
- STOP/DJVU Ransomware Vaccine (immunizes system against this type of ransomware)
- O&O ShutUp10 (recommended settings)
- O&O AppBuster (removed unecessary Windows 11 apps)
- Windows Sandbox
System settings:
- Microsoft Defender running in sandbox (inactive)
- Reputation Based Protections (all modules enabled)
- Smart App Control enabled
- Data Execution Prevention set to AlwaysOn
- Core Isolation: Memory Integrity enabled
- Kernel-mode Hardware-enforced Stack Protection enabled
- Secure Boot enabled
- Drives encrypted via TPM (BitLocker)
- Windows Update Delivery Optimization disabled
- AutoPlay disabled
- Network Discovery disabled (Public Firewall profile)
- PowerShell --> Constrained Language Mode
- Hide extensions for known file types --> disabled
- Show hidden files --> enabled
- Virtualization enabled (allows Application Sandboxing)
- Custom Exploit Protection Settings for Firefox:
Code:Block low integrity images - ON Block remote images - ON Block untrusted fonts - ON Control flow guard (CFG) - ON Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED Disable extension points - ON Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED Randomize memory allocations (Bottom-up ASLR) - ON Validate exception chains (SEHOP) - ON Validate handle usage - ON Validate heap integrity - ON Validate image dependency integrity - ON
Thanks to @oldschool for sharing!
ㅤㅤㅤHardware Firewall (Firewalla Blue Plus):
- Active Protect (Strict)
- Ad Block (Strict)
- OISD blocklist enabled in Firewalla
- New Device Quarantine (restricted internet access for newly connected devices)
- Geo-IP Filtering (blocking connections from and to Russian + Chinese IPs)
- Unbound DNS enabled for all devices
ㅤ
- Periodic malware scanners
-
Norton Power Eraser, X-Sec and AdwCleaner
- Malware sample testing
- I do participate in malware testing. See details about my testing environment below.
- Environment for malware testing
-
ㅤㅤㅤ
VMware Workstation Player + Mullvad VPN on host machine while connected to the guest network.
Online Malware Analysis Platforms that I use:
- FileScan.iO
- Intenzer Analyze
- Hybrid Analysis
- VirusTotal
- Sophos Intelix
- ANY.RUN
- Triage
- Kaspersky Threat Intelligence Portal
- Neiki.Dev
- ThreatZone
- UnpacMe
--> Currently I am barely testing
- Browser(s) and extensions
-
ㅤ
Mozilla Firefox v. 132.0.0
Extensions:
- Ghostery
- SafeToOpen
- Bitwarden
Browser privacy and security settings:
- Tracking protection: Strict (enables Total Cookie Protection)
- Enable secure DNS using: Max Protection
- HTTPS-only-mode enabled
- DuckDuckGo set as search engine
- Pocket disabled
- Sending DNT-requests disabled (enabling makes you more identifiable and barely gives any advantage on most sites.)
- Clearing browsing data on exit
- Search suggestions disabled
- Websites overview disabled
- Blocking incoming location, camera and microphone requests
- AutoPlay for audio and video disabled
- Firefox telemetry disabled (also in about:config)
- Blocking pop-ups
- Warn when websites try to install addons enabled
- Protection against fraudulent content and dangerous software enabled
about:config tweaks:
- network.dns.echconfig.enabled = true
- network.dns.use_https_rr_as_altsvc = true
- fission.autostart = true
- pdfjs.enableScripting = false
- network.IDN_show_punycode = true
- security.ssl.require_safe_negotiation = true
- geo.enabled = false
- webgl.disabled = true
- network.trr.mode = 3 (NextDNS)
ㅤㅤ
- Secure DNS
-
ㅤ
- NextDNS with DoH + OISD blocklist (Firefox exclusively)
- Unbound DNS (Network-wide)
ㅤ
- Desktop VPN
-
Proton VPN with Secure Core, NetShield and Permanent Kill Switch
- Password manager
-
ㅤBitwarden Premium
- Maintenance tools
-
PatchMyPC, RuckZuck, UpdateHub, HiBit Uninstaller and Windows built in tools for cleaning and optimization
- File and Photo backup
-
ㅤbackup to external drive when necessary
- Subscriptions
-
- Google One Standard 200GB
- System recovery
-
Aomei Backupper
- Risk factors
-
- Browsing to popular websites
- Browsing to unknown / untrusted / shady sites
- Opening email attachments
- Buying from online stores, entering banks card details
- Downloading software and files from reputable sites
- Gaming
- Streaming audio/video content from shady sites
- Downloading malware samples
- Computer specs
-
GPU: Nvidia Geforce RTX 360 TI
CPU: Intel I5 12600K
RAM: 16 GB DDR4-3200 Crucial
Hard disks: 500 GB Samsung 970 EVO Plus + 1 TB Western Digital Blue
- Notable changes
-
- Updated for year 2024
- What I'm looking for?
-
Looking for minimum feedback.
- Sep 2, 2021
- 2,586
I see that you use Adguard VPN, your opinion on it ?
Wireguard ?
Wireguard ?
- Feb 25, 2017
- 2,585
I am really satisfied. It feels fast and has a wide collection of servers. It doesn't have WireGuard as it uses its own protocol:I see that you use Adguard VPN, your opinion on it ?
Wireguard ?
AdGuard VPN protocol — How it works
AdGuard VPN relies on a unique protocol developed by AdGuard specialists. Learn how it completely masks your VPN connection and improves connectivity.
- Feb 25, 2017
- 2,585
- removed JSRestrictor + uBlock Origin
+ added Trace (Premium version)
+ added Trace (Premium version)
- Mar 29, 2018
- 7,613
Developer informed me he has no time to maintain this extension.
This is another "one man show" extension that will disappear with MV3, if Google actually rolls it out.
- Feb 25, 2017
- 2,585
Thanks for letting me know. He already said that in the past but continued updating it some weeks after. Will keep experimenting a bit and probably go back to uBlock Origin or AdGuard v. 4 anyway.
- Feb 25, 2017
- 2,585
- Aug 17, 2014
- 11,108
What's the reason? uBlockO makes it probably redundant?
- Feb 25, 2017
- 2,585
Yup, most trackers got already blocked by either Firefox with Strict mode, uBlock Origin or NextDNS. No need for another extension I guess.
- Feb 25, 2017
- 2,585
- added STOP/DJVU Ransomware Vaccine by @struppigel
- Mar 29, 2018
- 7,613
@SecureKongo did you get a free or discounted license for Sophos? How is it performing?
- Feb 25, 2017
- 2,585
I got a discount for Sophos. Well, I would lie if I said that it offers the best protection out there, but it's solid after all. I am currently testing Sophos on my VM too and I can say that it's really strong in detecting malicious PE-files with it's ML-engine. It still has problems with malicious scripts, but as I have it covered with SWH that isn't a problem. I mainly use it because of it's anti-exploit capabilites, Safe Browsing, Keystroke Encryption and risk-reduction protections. Performance-wise it is meh. As I got decent hardware it isn't really a problem for me, but for people with older PC's it might be a problem. Lastly I can say that it's really stable without any bugs as far as I am aware. Just try the trial if you are interested, I think that's the best way of finding out if it's crippling your PC or not.
- Mar 29, 2018
- 7,613
The last time I trialed it was heavy for my low-budget laptop with i3 8GB RAM. Good to hear your experience with it. Thanks!Just try the trial if you are interested, I think that's the best way of finding out if it's crippling your PC or not.
- Feb 25, 2017
- 2,585
- removed ESET Online Scanner
+ added Firewall Hardening
+ enabled Microsoft Defender shedule scans
+ added Firewall Hardening
+ enabled Microsoft Defender shedule scans
- Feb 25, 2017
- 2,585
- Sep 2, 2021
- 2,586
- Feb 25, 2017
- 2,585
Link for Firewall Hardening please ?
FirewallHardening tool
FIREWALLHARDENING (new ver. 3.0.0.1, July 2024) FirewallHardening is a part of the Hard_Configurator project and can be used also as a standalone application among a few others included in the H_C_HardeningTools repository...
malwaretips.com
There you go
- Feb 25, 2017
- 2,585
- changed from 1.1.1.1 (Cloudflare) to 9.9.9.9 (Quad9) system-wide (still using NextDNS for my browser)
- Apr 1, 2019
- 2,868
Quad9 is great. I used it for my entire home network.
- Nov 26, 2017
- 729
Similar threads
