Advanced Plus Security Lenny's 2021 intention: keep this setup for a year :-)

[Lenny_Fox]

May 2021 be a better year for all than 2020, stay safe and healthy

 

[ForgottenSeer 85179]

GPO security baseline implemented for about 90%

Wow. In the past i use them but revert as too much settings weren't designed for consumer.
Now i only use few which aren't available as settings native in Windows.

 

[Lenny_Fox]

Wow. In the past i use them but revert as too much settings weren't designed for consumer.
Now i only use few which aren't available as settings native in Windows.

Well I should have said 90% of the baseline which is applicable for home users, so I did not accomplished the feat you probably have in mind.

I am not disappointed when you change your WOW response to LIKE

Note: setting it through GPO has some advantages like settings not being changed by applications (e.g firewall blocks of ransomware related sponsors/lolbins misuse)

 

[ForgottenSeer 85179]

Maybe you can make a thread with your polices?

 

[Lenny_Fox]

Maybe you can make a thread with your polices?

Okay when I get bored having the same setup, I will dig into it (need to explain why also, so it is some work to make it usefull to others)

 

[Andy Ful]

Well I should have said 90% of the baseline which is applicable for home users, so I did not accomplished the feat you probably have in mind.

I am not disappointed when you change your WOW response to LIKE

Note: setting it through GPO has some advatages like settings not being changed by applications (e.g firewall blocks of ransomware related sponsors/lolbins misuse)

These settings can be changed by malware like any other Policies applied by editing the Registry. The only difference is that after several hours the GPO Refresh feature can restore the proper settings again. This cannot protect against ransomware attacks. Furthermore, if the malware is designed to fight the Policies, then it will be able to disable GPO Policies after they are restored, too.
Some Policies included in the baseline are in fact less restrictive than Windows default settings on Windows Home and Pro, so one has to understand well what they can do.

 

[harlan4096]

PassWord Manager? thanks for sharing

 

[Gandalf_The_Grey]

What was your reason to prefer Kaspersky Security Cloud Free over Microsoft Defender (with or without Configure Defender)?
Curious about that because you use so much other buit-in security features.

 

[Andy Ful]

ACL deny execute works only for: EXE, COM, SCR, BAT, and CMD files. The BAT and CMD files are blocked only when executed by the user directly from Explorer and not blocked when executed via command-line with cmd.exe.
ACL deny execute cannot block MSI installers, most scripts (Windows Script Host, PowerShell), and files with active content (CHM, HTA, MSC, etc.).

 

[Lenny_Fox]

ACL deny execute works only for: EXE, COM, SCR, BAT, and CMD files. The BAT and CMD files are blocked only when executed by the user directly from Explorer and not blocked when executed via command-line with cmd.exe.
ACL deny execute cannot block MSI installers, most scripts (Windows Script Host, PowerShell), and files with active content (CHM, HTA, MSC, etc.).

don't worry ACL is not only defense, also using SRP and WD-Exploit settings, just a few examples

HTA does not run on my desktop, simply enables all settings in WD exploit protection. In GPO I have disabled installers to elevate, so I need to run as admin ro install manually. WSH is also blocked with WD Exploit protection. Contrary to cmd files ps1 files cannot be run as admin, so they are blocked with SRP

 

[Lenny_Fox]

What was your reason to prefer Kaspersky Security Cloud Free over Microsoft Defender (with or without Configure Defender)?
Curious about that because you use so much other buit-in security features.

Last year I used Hard Configurator like and Configure Defender like settings (like because I set it manually in GPO), thanks to @Andy Ful I learned how to copy the settings of his great utilities*. Yes I like to use security what is already provided by Windows itself.

Reason to choose Kaspersky Cloud Free was that a husband of (girf)firend of my girlfriend put it on for her. He is an IT-er, I am a digital marketeer, so she figured the husband of her friend knew more about security than I did. So because I decided on same setup for all pc's I changed my setup

The guy convinced my girlfriend to change by showing how fast kaspersky icon appears and how slow the WD-icon appears,

* I did not like the nested allow exceptions for TMP files @Andy Ful makes with HC and SWH, everything runs/updates/install fine without this TMP hole in my SRP defence

 

[Andy Ful]

don't worry ACL is not only defense, also using SRP and WD-Exploit settings, just a few examples

HTA does not run on my desktop, simply enables all settings in WD exploit protection. In GPO I have disabled installers to elevate, so I need to run as admin ro install manually. WSH is also blocked with WD Exploit protection. Contrary to cmd files ps1 files cannot be run as admin, so they are blocked with GPO

How do you block Windows Script Host by Exploit Protection?

 

[Gandalf_The_Grey]

Last year I used Hard Configurator like and Configure Defender like settings (like because I set it manually in GPO), thanks to @Andy Ful I learned how to copy the settings of his great utilities*. Yes I like to use security what is already provided by Windows itself.

Reason to choose Kaspersky Cloud Free was that a husband of (girf)firend of my girlfriend put it on for her. He is an IT-er, I am a digital marketeer, so she figured the husband of her friend knew more about security than I did. So because I decided on same setup for all pc's I changed my setup

The guy convinced my girlfriend to change by showing how fast kaspersky icon appears and how slow the WD-icon appears,

* I did not like the nested allow exceptions for TMP files @Andy Ful makes with HC and SWH, everything runs/updates/install fine without this TMP hole in my SRP defence

That icon thing is a little trick of Kaspersky, because when you click on it after a reboot it still take a while to load the full program.
But it's not a bad program for protection.

 

[Andy Ful]

...
* I did not like the nested allow exceptions for TMP files @Andy Ful makes with HC and SWH, everything runs/updates/install fine without this TMP hole in my SRP defence

If you allow EXE files, then allowing TMP files is logical and generally necessary, except when some installations do not use wrappers. You cannot run manually TMP files, they have to be run/loaded by the already running process. So, TMP files are not dangerous if the initial vectors of attack are properly covered. Furthermore, If one uses The H_C Strict_Recommended settings, then EXE and TMP files are blocked, too. One can also skip using the H_C's option and use his/her own setup to allow EXE files without allowing TMP files.

Anyway, if you have properly blocked/restricted scripts then your setup is OK in the home environment. Other vectors of attack are not so important with Kaspersky's protection.

 

[harlan4096]

That icon thing is a little trick of Kaspersky, because when you click on it after a reboot it still take a while to load the full program.

It's K. GUI what takes some seconds to appears after every system start, protection services are enabled during early stage of Windows boot...

 

[Gandalf_The_Grey]

It's K. GUI what takes some seconds to appears after every system start, protection services are enabled during early stage of Windows boot...

Yes I know, but that was only the illustrate that the K icon showing up earlier than the Microsoft Defender icon tells you nothing.
Protection has already been started in both cases.

 

[ForgottenSeer 85179]

Reason to choose Kaspersky Cloud Free was that a husband of (girf)firend of my girlfriend put it on for her. He is an IT-er, I am a digital marketeer, so she figured the husband of her friend knew more about security than I did. So because I decided on same setup for all pc's I changed my setup

This doesn't mean this guy know what he talking about.

A lot IT guys doesn't have the knowledge MT members have

 

[Lenny_Fox]

How do you block Windows Script Host by Exploit Protection?

Simply enable all protections of WD-exploit, it breaks wscript, so it can't run same with mshta.exe

 

[Lenny_Fox]

This doesn't mean this guy know what he talking about.

A lot IT guys doesn't have the knowledge MT members have

True but her employer provided on-line security lessons to create security awareness (because they were forced to collaborate/meet/work digitally with Covid19. Upside is that she applies safe hex now (downside is that she does not take my word for security any more )

Her employer did it very smart. When you passed a (security awareness) test, you could order something to create a better home workplace. With every successful course finished employees got a bonus. With these incentives she got a large monitor and keyboard to go with her work laptop, a desk which you can change in height (so it is also possible to stand working), a good office chair, a 40 euro per month allowance for faster internet connection and our new AC4000 triband router (so she has one 5Ghz network for her own for work with VPN pass through).

 

[Lenny_Fox]

PassWord Manager? thanks for sharing

Sensitive stuff I remember by head, fun stuff (like MT-forum login) I am using Edge password manager.