Advanced Plus Security Max90 Security Config 2023

[Max90]

Here is my super solid security setup using Microsoft Security only (okay it is my hobby, so would be a shame when I would post a weak setup).

I am running an all Microsoft setup with only three non Microsoft third-party programs (Macrium reflect free, Syncback free and SophosScanAndClean)

Using WDAC-Toolkit since Version 1, that is why this setup has been unchanged and stable since 2019. This is also the reason why I did not update Microsoft Security Baseline policies from 2019 (don't fix when it ain't broken). Recent updates were Windows 10 22H2, Macrium reflect 7 to 8 and Syncback 9 to 10. I am still on Office 2019 (not planning to move to office 365). The only other changes I made last three years were updating Edge hardened settings and use of extensions.

I have been running this quadruple whitelisting approach (ELAM, MAX, WDAC, SRP) on Standard User since 2019 and have no updating issues nor daily usage limitations, so unless there is a compelling reason to change, I will be keeping those four whitelist/deny layers until Windows 10 won't be supported anymore. Tips on browser extensions (Advertising and URL protection) are welcome, though, so feel free to post tips on advertising and malware blocking extensions.

 

[Back3]

On Black Friday, sometimes, you can get a discounted copy of Macrium Home for a good price and enable Image Guardian.

 

[Victor M]

Hi Max90,

Does a WDAC protected box allow Windows Update ?

 

[Max90]

Hi Max90,

Does a WDAC protected box allow Windows Update ?

Yes it works flawlessly when allowing Windows signed programs. Allow all Microsoft is a default profile you can select in the WDAC-toolkit. It is easy to select other (additional) signers. You can open a signed program and teh WDAC toolkit reads all the details, next you can select the allow level (just like in AppLocker).

 

[Max90]

PFEW I should have stayed a lurker. This forum is so addictive I had to install Dark Reader

 

[Kongo]

PFEW I should have stayed a lurker. This forum is so addictive I had to install Dark Reader

There is a dark mode tho.

 

[Max90]

@Kongo I found it, thanks

I keep dark mode extension because I sort of developed the habit to visite other websites while watching / waiting for new posts answers on MT. Noticed that I am more onlin e and dark mode is easier on the eyes.

 

[Max90]

Added Adguard V4 again because Microsoft supports MV2 until january 2024 (link)

I used mostly Adguard filters but was attended to other filter listthanks to @Jan Willy
- Kees1958 addendum to Disconnect filters used by Edfe and Firefox (link)
- Kees1958 tracking param filter (link)
- LennyFox videos (youtube) filter (link)
- LenyFox news websites (link)

User rules: Jan Willy's easy medium mode (link) denyallow=com|edu|eu|inf|io|ms|net|nl|org with 1 allow exception
@@*.uk.co/^$domain=bbc.com

(also Adguard DNS and Next DNS and OISD filters enabled on NextDNS)

 

[Jan Willy]

Besides using this filterlist 'Tracking servers: https://raw.githubusercontent.com/A...r/SpywareFilter/sections/tracking_servers.txt ' you use (on DNS level) Adguard DNS.
In last mentioned list is the 'Tracking servers' list (partially?) integrated. View: GitHub - AdguardTeam/AdGuardSDNSFilter: AdGuard Simplified Domain names filter

 

[Max90]

@Jan Willy

Thanks for attending me on this. It looks like I can omit the tracking servers list. rule count dropped by 5000 rules to just over 2700

I ran AG MV3 with Next DNS and Edge ant-tracking on STRICT with only User Rules. Problem with AG MV3 is that it has not (yet) such an excellent logger like AG V4 which I am running now. I am getting used to AG more and more and I am actually finding AG's logger easier to use than uBO's logger (at least for my use of looking at cosmetic rules and checking effectiveness of own user rules).I am getting more and more convinced that DNS privacy filters are well suited for blocking trackers and advertisements (at least when using well curated filterlists like Next, AdGuard and OISD)

 

[Max90]

Pitched up my SRP from SWH-like behavior (allowing exe and msi, blocking all other risky file extensions) to a full default deny for standard user in user space

Thanks @Gandalf_The_Grey for posting this: Security News - Microsoft-signed malicious Windows drivers used in ransomware attacks

Spoiler: WDAC and SRP in action

according to Microsoft I need to contact a support person for WDAC and my system administrator for SRP.

 

[oldschool]

Some serious redundancy going on with your latest addition, but complex to set up. WDAC just isn't user-friendly.

This is a nice addition:

Defender Exploit Protection code integrity enabled for Explorer, Svchost, Powershell,

according to Microsoft I need to contact a support person for WDAC and my system administrator for SRP.

 

[Max90]

Some serious redundancy going on with your latest addition, but complex to set up. WDAC just isn't user-friendly.

They are different mechanism, which kick-in after each other.

User folders for standard user: WDAC allow Microsoft & Syncback + WD MAX cloud whitelist + SRP default deny in user space + Protected Folders cloud based write & delete whitelist
User folders for admin: WDAC allow Microsoft & Syncback + WD MAX cloud whitelist
UAC protected folders: WD MAX cloud whitelist

All Microsoft signed and Syncback update without problems. Windows updates without requiring admin elevation. I use my PC to work and relax, not for installing or trying out programs.

You can set WDAC to fallback to AUDIT mode in case of critical issues. While running in AUDIT mode you can use the output to add exclusions. For a whitelisting tool it is fairly user friendly. I don't want a whitelist solution communicating through a user-mode program to respond to blocks (and allow them). Such a tunnel between ring3 and ring0 kills the idea of rights segregation. But yes whitelisting solutions are not user friendly by design.

 

[Max90]

Disabled Trend Micro malware URL filter because it allows HTTPS://www.malware.com while it blocks malware.com. So it only seems to check un-encrypted DNS requests, which sortof makes it a less than marginal useful check. Kept all other Home care options enabled. Added Bitdefender TrafficLight to Edge.

 

[Max90]

After some URL testing (link), I decided for MBAM Browser Guard (reason), This is not because extension A is better than B, but because it is the most complementary with the other URL phishing/scam/malware filtering mechanisms I am already using. So I settled for malware URL-filtering protection:
1. NextDNS with all security protections enabled with non-latin character TLD domains blocked (manually selected all Arabic, Chinese, Cyrillic, Hindi character TLD's from the list)
2. TrendMicro Web Reputation Service in my router
3. Microsoft SmartScreen enabled in Edge
4. MBAM Browser Guard with advertising protection disabled and suspicious TLD blocking enabled

After implememting the Tips of JanWilly I am using the following filters
1. NextDNS with NextDNS, AdGuardDNS and OISD filters
2. Edge Anti-Tracking on STRICT
3. AdGuard V4 with
- Kees1958 addendum to Disconnect filters used by Edge and Firefox
- Kees1958 tracking param filter
- LennyFox videos (youtube) filter
- LennyFox news websites
- User rules as posted by JanWilly (easy Medium mode)

Thanks for all feedback and suggestions

 

[Jan Willy]

TrendMicro malware-URL filter in my router

Are you KPN-customer? If yes, this could be interesting for you: Malwarefilter van KPN | KPN Community

 

[Max90]

Are you KPN-customer? If yes, this could be interesting for you: Malwarefilter van KPN | KPN Community

No I am a Ziggo customer. Thanks for the tip

 

[Max90]

After daily malware URL testing for a week, comparing several malware block extensions and comparing the best extension with using no extention at all (only NextDNS, router and browser build-in), I noriced that it is really not making any difference, therefor applying Occam's Razor principle and removed the URL malware filter extension in the browser. I also decided after NextDNS ad filters blocking something, that it is easier to apply to old rule: block malware URL's at DNS and ads in the browser and disabled privacy filters in NextDNS. For the same reson (only having to disable AdGuard) I set Edge anti-tracking to default again.