Advanced Plus Security Kongo's PC Security Config

[Kongo]

- removed Configure Defender
- replaced Microsoft Defender with Sophos Intercept X (trial)

Just want to see how the endpoint protection of Sophos performs for a few days.

 

[Kongo]

- replaced AdGuard Windows with AdGuard Browser extension and NextDNS via YogaDNS for now. (Sophos Intercept X also prevents AdGuard Windows from filtering)
- removed Flagfox
- added ClearURLs

 

[klepto]

I use NextDNS with YogaDNS too, the NextDNS client for Windows is kinda meh.. Is Sophos Intercept X better than Hitman Pro Alert? How has it worked for you?

 

[Kongo]

I use NextDNS with YogaDNS too, the NextDNS client for Windows is kinda meh.. Is Sophos Intercept X better than Hitman Pro Alert? How has it worked for you?

HitmanPro.Alert is integrated into Sophos Intercept X so it should perform similiar in terms of exploit and ransomware protection. It has some extra features that are not included in HitmanPro.Alert nor Sophos Home Premium.

Here are the Threat Protection Policies of Intercept X if you are interested:

Spoiler: Policies

1.

2.

3.

 

[klepto]

That is quite a large feature set but I appreciate that they give you options and not just hoover all your data and send it to Sophos. How is the resource usage?

 

[Kongo]

That is quite a large feature set but I appreciate that they give you options and not just hoover all your data and send it to Sophos. How is the resource usage?

Well, CPU usage is fine, but the RAM usage and the amount of processes is quite a lot. I have 16 Gb of RAM so I didn't run into any problems for now, but for older systems it might be an issue.

Spoiler: Usage

This is the usage after one day of use and after performing a system scan. Might be lower after some days of use...

 

[ZeePriest]

- removed Configure Defender
- replaced Microsoft Defender with Sophos Intercept X (trial)

Just want to see how the endpoint protection of Sophos performs for a few days.

How is Sophos so far? Is it light? Do you recommend it? and is there a free version? I would like to try it after my subscription with BD ends...

 

[Kongo]

How is Sophos so far? Is it light? Do you recommend it? and is there a free version? I would like to try it after my subscription with BD ends...

I wouldn't say that it's too light but not too heavy, but there are definitely lighter solutions out there. At the moment I don't recommend the home version of Sophos, if you check out the tests in the Malware Hub here on MalwareTips you will understand. It does have a free version, but it's pretty basic and can't keep up with Kaspersky Free, Microsoft Defender or Bitdefender Free if you ask me. I think Sophos Home Premium has a lot of potential but things like their AMSI scanning (script protection) have to be improved in the future if it wants to compete with the big players like Kaspersky. After all it's not right to say that Sophos is bad, it has good ranswomware protection and also good exploit protection. (thanks to HitmanPro.Alert) If you wan't to give it a try then do it, I'm sure it will offer solid protection after all. Keep in mind that I'm using the business version at the moment, so the protection may differ from the home version, as some modules are missing in the version for Home users. Hope it helped!

 

[ZeePriest]

I wouldn't say that it's too light but not too heavy, but there are definitely lighter solutions out there. At the moment I don't recommend the home version of Sophos, if you check out the tests in the Malware Hub here on MalwareTips you will understand. It does have a free version, but it's pretty basic and can't keep up with Kaspersky Free, Microsoft Defender or Bitdefender Free if you ask me. I think Sophos Home Premium has a lot of potential but things like their AMSI scanning (script protection) have to be improved in the future if it wants to compete with the big players like Kaspersky. After all it's not right to say that Sophos is bad, it has good ranswomware protection and also good exploit protection. (thanks to HitmanPro.Alert) If you wan't to give it a try then do it, I'm sure it will offer solid protection after all. Keep in mind that I'm using the business version at the moment, so the protection may differ from the home version, as some modules are missing in the version for Home users. Hope it helped!

Thanks for the elaboration and yes it helped a lot

 

[Kongo]

+ enabled site isolation for Firefox in about:config (fission.autostart = true)

 

[Morro]

+ enabled site isolation for Firefox in about:config (fission.autostart = true)

Should that be bolean?

 

[Kongo]

Should that be bolean?

Make sure that you entered it correctly. There shouldn't be such an option.

 

[Morro]

Make sure that you entered it correctly. There shouldn't be such an option.

View attachment 258220

Alright, thank you.

 

[Kongo]

Nice post, really helpfull
but for Mozilla have those tweaks, for privacy and security without any trouble.
More info here: Mozilla Firefox and a bit better Privacy /// Privacy Guide /// arkenfox/user.js /// Firefox Hardening Guide 2018
about:config tweaks:

Spoiler

-----------------------------------------------------------
accessibility.force_disabled =1
javascript.options.asmjs = false
javascript.options.wasm = false
layout.css.visited_links_enabled = false
-----------------------------------------------------------
privacy.cpd. = all true
privacy.clearOnShutdown = all true
plugin.scan.plid.all =false
pdfjs.enableScripting = false
privacy.firstparty.isolate =true
-------------------------------------------------------------
security.ssl3.rsa_aes_128_gcm_sha256 =false
security.ssl3.rsa_aes_256_gcm_sha384 =false
security.ssl3.ecdhe_ecdsa_aes_128_sha =false
security.ssl3.ecdhe_rsa_aes_128_sha =false
security.ssl3.rsa_aes_128_sha =false
security.ssl3.rsa_des_ede3_sha =false
security.ssl3.ecdhe_ecdsa_aes_256_sha =false
security.ssl3.ecdhe_rsa_aes_256_sha =false
security.ssl3.rsa_aes_256_sha =false
security.ssl.disable_session_identifiers = true
security.ssl.enable_false_start = false
security.tls.enable_0rtt_data =false
security.ssl.require_safe_negotiation = true
security.tls.enable_delegated_credentials =true
security.tls.enable_post_handshake_auth = True
security.tls.hello_downgrade_check = False
security.mixed_content.block_display_content = true
security.mixed_content.block_object_subrequest = true
security.mixed_content.upgrade_display_content = true
security.secure_connection_icon_color_gray = false
security.insecure_connection_text.enabled = true
security.insecure_connection_text.pbmode.enabled = true
security.remote_settings.crlite_filters.enabled = true
security.pki.sha1_enforcement_level =1
security.cert_pinning.enforcement_level =2
security.pki.crlite_mode =2
security.family_safety.mode =0
security.enterprise_roots.enabled =true
--------------------------------------------------------------
beacon.enabled = false
browser.cache.offline.enable = false
browser.cache.disk.enable = false
browser.cache.disk_cache_ssl = false
browser.cache.memory.enable = false
browser.cache.insecure.enable =false
browser.urlbar.speculativeConnect.enabled = false
browser.fixup.alternate.enabled = false
browser.urlbar.trimURLs =false
browser.shell.shortcutFavicons =false
browser.ssl_override_behavior =1
browser.sessionstore.privacy_level = 2
browser.send_pings.max_per_link = 0
browser.sessionstore.max_tabs_undo = 0
browser.urlbar.dnsResolveSingleWordsAfterSearch = 0
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.newtabpage.activity-stream.telemetry = false + Blank Url Pages
browser.newtabpage.activity-stream.filterAdult = false
browser.tabs.crashReporting.sendReport = false
browser.ping-centre.telemetry = false
browser.taskbar.lists.enabled = false
browser.taskbar.lists.frequent.enabled = false
browser.taskbar.lists.tasks.enabled = false
browser.uitour.enabled = false
browser.aboutConfig.showWarning = false
----------------------------------------------------------------
dom.ipc.plugins.flash.subprocess.crashreporter.enabled = false
dom.ipc.plugins.reportCrashURL = false
dom.security.https_only_mode_pbm = true
dom.security.https_only_mode_send_http_background_request = false
dom.security.https_only_mode.upgrade_local = true
dom.block_download_insecure = true
dom.popup_allowed_events = click dblclick mousedown pointerdown
dom.event.contextmenu.enabled = false
dom.event.clipboardevents.enabled = false
dom.allow_cut_copy = false
dom.battery.enabled = false
dom.vr.enabled = false
dom.gamepad.enabled = false
dom.vibrator.enabled = false
-----------------------------------------------------------
network.dns.disablePrefetch = true
network.predictor.enabled = false
network.prefetch-next = false
network.dns.echconfig.enabled = true
network.dns.use_https_rr_as_altsvc = true
network.http.http3.enabled = true
network.trr.mode = 3
network.cookie.thirdparty.sessionOnly = true
network.cookie.thirdparty.nonsecureSessionOnly = true
network.IDN_show_punycode = true
network.http.speculative-parallel-limit =0
network.http.referer.XOriginPolicy = 1
network.http.referer.XOriginTrimmingPolicy = 2
network.auth.subresource-http-auth-allow =1
---------------------------------------------------------
media.gmp-widevinecdm.enabled = false
media.eme.enabled = false
media.navigator.enabled = false
media.peerconnection.video.vp9_enabled = false
media.peerconnection.identity.enabled = false
media.peerconnection.dtmf.enabled = false
media.peerconnection.enabled = false
media.peerconnection.use_document_iceservers = false
media.peerconnection.video.enabled = false
media.peerconnection.identity.timeout = 1
media.getusermedia.screensharing.enabled = false
media.peerconnection.turn.disable = true
media.peerconnection.ice.default_address_only = true
-----------------------------------------------------
datareporting. = false + Blank Url Pages
device.sensors.enabled = false
webgl.disabled = true
webgl.disable-wgl = true
identity.fxaccounts.enabled = false
toolkit.telemetry = all false + Blank Url Pages
extensions.pocket.enabled = false
app.normandy.enabled =false
geo.enabled =false

Extensions
--------------------------------
HTTPS Everywhere
Encrypt All Sites Eligible is ON
---------------------------------
NoScript
---------------------------------
Ublock Origin
Add

AdGuard Base
AdGuard Tracking Protection
AdGuard Annoyances
EasyList Cookie
MVPS HOSTS

Custom Filters
Web Annoyances Ultralist

https://raw.githubusercontent.com/yourduskquibbles/webannoyances/master/ultralist.txt

Damn, those are a lot... You really aren't facing any problems with all those tweaks enabled?
HTTPS Everywhere isn't necessary in Firefox anymore btw, it's integrated already. When setting tracking protection to strict in Firefox, you don't need First Farty Isolation either, as setting it to strict enables Total Cookie Protection which is an improved and more user friendly option of FPI.

 

[Kongo]

Personally no i don't face any kind of problems. I use this tweaks about 6 months and all works fine until now.
Thanks for the info about Https, i remove it.

You have to enable it in the settings tho

 

[Kongo]

- replaced Sophos Intercept X with AVG Internet Security
- replaced YogaDNS with AdGuard Windows

 

[blackice]

- replaced Sophos Intercept X with AVG Internet Security

If you have 3D mark installed give it a test. Something is up with frame rates in many games with AVG installed. And 3D mark took a nearly 10% hit to the cpu score, showing the source of my issue. I reported it to their team and they sent it on to the engineers. I never heard back.

 

[Kongo]

If you have 3D mark installed give it a test. Something is up with frame rates in many games with AVG installed. And 3D mark took a nearly 10% hit to the cpu score, showing the source of my issue. I reported it to their team and they sent it on to the engineers. I never heard back.

Might be caused by the gaming or no notification mode. Will see if I face the same issues, thanks for letting me know.

 

[blackice]

Might be caused by the gaming or no notification mode. Will see if I face the same issues, thanks for letting me know.

I seemed to have it no matter what I turned in or off. Not a problem for everybody, though. Except 3D Mark does seem to hate whatever they’re doing.

 

[Moonhorse]

Thats a one very well detailed config, only thing wich comes into my mind is fallback browser if you run into problems with those tweaks of firefox

Heres checklist if you find anything helpful, you could add it as you have firefox tweak sites noted:

GitHub - lissy93/personal-security-checklist: 🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026 - lissy93/personal-security-checklist

github.com