Advanced Plus Security Kongo's Computer Security Config 2024

[Kongo]

Thats a one very well detailed config, only thing wich comes into my mind is fallback browser if you run into problems with those tweaks of firefox

Heres checklist if you find anything helpful, you could add it as you have firefox tweak sites noted:

GitHub - Lissy93/personal-security-checklist: 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2024

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2024 - Lissy93/personal-security-checklist

github.com

Damn, thats quite a lot of stuff to look at. Thanks for sharing!

 

[Kongo]

+ added CSS Exfil Protection to Firefox (based on @Moonhorse recommended GitHub site)
- replaced old referer about:config tweaks with "network.http.referer.spoofSource = true" which sets the target URL as the referer. (Might result in website breakage)

 

[Kongo]

- replaced AVG Internet Security with Cylance Smart Antivirus again. Cylance performed best for me and is a great combo with Simple Windows Hardening that blocks file types that Cylance doesn't detect.

 

[Andy Ful]

It would be interesting to test this combo on MH. If on EXE files Cylance could be as effective as Defender (HIGH settings), then SWH + Cylance would be a nice combo. Some incomplete tests (rather presentations than tests) can suggest that on malicious EXE files Defender on HIGH settings can be more effective than Cylance.




Of course, the results of the "tests" on the PC Security Channel are only unverified suggestions.
Anyway, any AV (also slightly tweaked) which is as effective as Defender (HIGH settings) is worth attention.

 

[Kongo]

It would be interesting to test this combo on MH. If on EXE files Cylance could be as effective as Defender (HIGH settings), then SWH + Cylance would be a nice combo. Some incomplete tests (rather presentations than tests) can suggest that on malicious EXE files Defender on HIGH settings can be more effective than Cylance.




Of course, the results of the "tests" on the PC Security Channel are only unverified suggestions.
Anyway, any AV which is as effective as Defender (HIGH settings) is worth attention.

Would love to test Cylance and SWH in the Hub, but I think this isn't working like that. SWH would block pretty much all the samples (jar, vbs, js). As you saw in recent tests in the Hub, there are some days where only malicious scrips are shared for testing. I think it is predictable that SWH will block all of them. Those results are simply not highliting the performance of the main AV (Cylance) which is the basic idea behind the tests. Nonetheless I will ask @upnorth and @harlan4096 what they think about this as I am also interested in that combo.

 

[Intel_iRIS81]

I'm curious about the reason for using 3 different driver update programs? Comparing differences and which one of the 3 would you recommend

 

[Kongo]

I'm curious about the reason for using 3 different driver update programs? Comparing differences and which one of the 3 would you recommend

Sumo and PatchMyPc are software updaters, and not driver updaters. The only driver updater I (had) is Driver Easy, I just forgot to remove it from my config... So now I am only using Windows built updates to update the most important drivers, and GeForce Expierence for my GPU. From the software updaters I can recommend both. PatchMyPC is the more convenient option of the two, as it can install software updates with one click. Sumo however detects far more programs than PatchMyPc but can't update them within the software and only rederects you to the website of the program. I would recommend using both, as PatchMyPC is portable and doesn't even require any installation at all.

 

[ForgottenSeer 85179]

GeForce Expierence for my GPU

Remember that "Experience" had some security vulnerabilities in the past.

If you regulary read some IT news sites, I'm sure you always know about updates so doing it manually keeps your system safer

 

[Kongo]

Remember that "Experience" had some security vulnerabilities in the past.

If you regulary read some IT news sites, I'm sure you always know about updates so doing it manually keeps your system safer

I think all vulnerabilities were patched by now? I didn't really hear much about that, so correct me if I am wrong...

Nvidia Geforce Experience : Security vulnerabilities, CVEs

Security vulnerabilities of Nvidia Geforce Experience : List of vulnerabilities affecting any version of this product

www.cvedetails.com

 

[ForgottenSeer 85179]

I think all vulnerabilities were patched by now? I didn't really hear much about that, so correct me if I am wrong...

Nvidia Geforce Experience : Security vulnerabilities, CVEs

Security vulnerabilities of Nvidia Geforce Experience : List of vulnerabilities affecting any version of this product

www.cvedetails.com

For now yes but let's see how that change

If you don't need Experience for game tuning, I recommend not install it.

 

[Andy Ful]

Would love to test Cylance and SWH in the Hub, but I think this isn't working like that. SWH would block pretty much all the samples (jar, vbs, js). As you saw in recent tests in the Hub, there are some days where only malicious scrips are shared for testing. I think it is predictable that SWH will block all of them. Those results are simply not highliting the performance of the main AV (Cylance) which is the basic idea behind the tests.

Yes, you are right. I was thinking about the comparison of detections on EXE files:
Cylance vs. Defender (HIGH settings, SWH is often used with Defender).

By the way, it would be interesting to use one fixed AV in all MH tests, as a reference detection. It could be any AV (with settings agreed by testers) that would reflect the average (in a statistical sense) detection of commercial AVs.

 

[Kongo]

Yes, you are right. I was thinking about the comparison of detections on EXE files:
Cylance vs. Defender (HIGH settings, SWH is often used with Defender).

But then the Hub isn't the right playground for such comparisons, as exe samples are the least shared ones for the tests.

By the way, it would be interesting to use one fixed AV in all MH tests, as a reference detection. It could be any AV (with settings agreed by testers) that would reflect the average (in a statistical sense) detection of commercial AVs.

You better share this idea with @upnorth or @harlan4096 as they are in charge of the Malware Hub tests and the procedures.

 

[Andy Ful]

But then the Hub isn't the right playground for such comparisons, as exe samples are the least shared ones for the tests.

Yes, that can be a problem. But if you like, you can test Cylance for a few months on all samples and then look if there is a significant difference (for EXE files) compared to top AVs tested on MH at the same testing period.
It seems that Cylance was tested on MH two years ago. Cylance got very poor scores in AV-Test. It was tested 3 times in the Consumer category in 2020 June, August, October, and in the Business category April, June, August, October. It would be interesting if the poor results are related to scripts, macros, etc. (covered in your setup by SWH).

 

[Kongo]

Yes, that can be a problem. But if you like, you can test Cylance for a few months on all samples and then look if there is a significant difference (for EXE files) compared to top AVs tested on MH at the same testing period.

Will add it in my next voting on my profile.

It would be interesting if the poor results are related to scripts, macros, etc. (covered in your setup by SWH).

That must be the case, as Cylance literally only detects PE-files...

https://support.blackberry.com/kb/articleDetail?articleNumber=000067395

 

[Andy Ful]

That must be the case, as Cylance literally only detects PE-files...

Yes, this is a very probable explanation for the most part of the poor results. But, we still do not know how effective can be Cylance on PE files. We have only PC Security Channel "tests" that suggest a more complex scenario. Anyway, the effectiveness of Cylance increases for fresher samples (like in MH), so the results can be interesting.

 

[Andy Ful]

Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.

Edit
If the impact of SWH on the detection of PE files will be visible, then I can consider adding the enforcement for 'All users' to SWH. For now, I think that adding it is questionable.

 

[Kongo]

Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.

I reached out to @upnorth and @harlan4096 and asked if it's possible to do the combo. As you already said, combos were allowed before, but now after some rule changes they are not anymore. This is due to the fact that it can be very confusing for some of the viewers of the tests and could result in a "Wild Western" of security software tests here on the Hub. (to quote @upnorth ) I also have to agree with him, as results of the combo would be very predictable and don't really show the capabilities of the AV.

 

[Andy Ful]

I reached out to @upnorth and @harlan4096 and asked if it's possible to do the combo. As you already said, combos were allowed before, but now after some rule changes they are not anymore. This is due to the fact that it can be very confusing for some of the viewers of the tests and could result in a "Wild Western" of security software tests here on the Hub. (to quote @upnorth ) I also have to agree with him, as results of the combo would be very predictable and don't really show the capabilities of the AV.

I respect this decision, although it has some serious cons.
The case of Cylance is special. It is not a full AV that can detect all files - it can detect only PE files. So, one can argue that Cylance alone should not be tested at all on MH alongside the full AVs. The comparison with full AVs will probably prevent many users from using Cylance.
On the other side, testing it with an anti-script layer without showing the real detection of Cylance alone, would be confusing and could promote Cylance compared to other AVs. In my opinion, the only fair solution is performing the dual test = Cylance alone compared to Cylance + anti-script layer. This would clearly show the pros and cons of using Cylance. Furthermore, this would be fair for all, including Home users that search for sensible protection.

There is no perfect way of testing such products as Cylance, so we should accept the final decision of the MH testers.

Post edited.

 

[Kongo]

I respect this decision, although it has some serious cons.
The case of Cylance is special. It is not a full AV that can detect all files - it can detect only PE files. So, one can argue that Cylance alone should not be tested at all on MH alongside the full AVs. The comparison with full AVs will probably prevent many users from using Cylance.
On the other side, testing it with an anti-script layer without showing the real detection of Cylance alone, would be confusing and could promote Cylance compared to other AVs. In my opinion, the only fair solution is performing the dual test = Cylance alone compared to Cylance + anti-script layer.

There is no perfect way of testing such products as Cylance, so we should accept the final decision of the MH testers.

I am quite new in the Hub and don't think that I am the right contact person in that case. I understand your doubts and also what you are trying to say, but I think you should discuss that further in a private chat with either @upnorth or @harlan4096 if you want.

 

[Andy Ful]

I am quite new in the Hub and don't think that I am the right contact person in that case. I understand your doubts and also what you are trying to say, but I think you should discuss that further in a private chat with either @upnorth or @harlan4096 if you want.

I am sorry for bloating your thread. I think that the problem does not require further discussion. The MH testers know best what to do.