Advice Request Must have security software for a Windows 10 Enterprise Laptop?

[cartaphilus]

What would you install and how would you configure windows 10 Enterprise? I am already running F-Secure

 

[Bot]

What would you install and how would you configure windows 10 Enterprise? I am already running F-Secure

If you're setting up a new laptop with Windows 10 Enterprise and already running F-Secure, here are some additional security software and configuration settings you can use to enhance your system's security:

1. Security Software:
   • a. Malwarebytes: Install Malwarebytes alongside F-Secure for additional malware protection.
   • b. GlassWire: Use this network monitoring tool to track your network activity and detect potential threats.
   • c. VeraCrypt: Install VeraCrypt for encrypting your sensitive files and folders.
   • d. 1Password or LastPass: Use a password manager to securely store and manage your passwords.
2. Windows 10 Enterprise Configuration:
   • a. Enable BitLocker: Turn on BitLocker Drive Encryption to protect your data in case of device theft or unauthorized access.
   • b. Windows Defender Firewall: Ensure the Windows Defender Firewall is enabled and properly configured.
   • c. Configure User Account Control (UAC): Set UAC to "Always notify" to ensure you're prompted for any changes to your system.
   • d. Disable Autorun: Turn off Autorun to prevent malware from automatically executing when external devices are connected.
   • e. Enable Controlled Folder Access: This feature in Windows Defender will help protect important folders from unauthorized changes.
   • f. Windows Updates: Configure automatic updates to ensure your system is always up-to-date with the latest security patches.
   • g. Disable unnecessary services: Reduce your system's attack surface by disabling services you don't need.
   • h. Configure Group Policy: Use the Group Policy Management Console (GPMC) to enforce security policies and settings throughout your system.
   • i. Configure AppLocker: Use AppLocker to restrict the execution of unauthorized software on your system.
   • j. Network security: Configure your network settings to use a secure DNS provider and set up a VPN for secure browsing on public Wi-Fi networks.
3. Additional Configuration:
   • a. Regularly update all installed software: Make sure to keep all your installed software up-to-date to prevent potential security risks.
   • b. Backup your data: Regularly back up your important files to an external drive or cloud storage to prevent data loss.
   • c. Educate yourself and your employees: Stay informed about security best practices and train your employees to follow them.

These are just a few recommendations for enhancing the security of your laptop running Windows 10 Enterprise. Your specific security requirements might vary based on your use case and the sensitivity of the data you work with.

 

[Gandalf_The_Grey]

If you're setting up a new laptop with Windows 10 Enterprise and already running F-Secure, here are some additional security software and configuration settings you can use to enhance your system's security:

1. Security Software: a. Malwarebytes: Install Malwarebytes alongside F-Secure for additional malware protection. b. GlassWire: Use this network monitoring tool to track your network activity and detect potential threats. c. VeraCrypt: Install VeraCrypt for encrypting your sensitive files and folders. d. 1Password or LastPass: Use a password manager to securely store and manage your passwords.
2. Windows 10 Enterprise Configuration: a. Enable BitLocker: Turn on BitLocker Drive Encryption to protect your data in case of device theft or unauthorized access. b. Windows Defender Firewall: Ensure the Windows Defender Firewall is enabled and properly configured. c. Configure User Account Control (UAC): Set UAC to "Always notify" to ensure you're prompted for any changes to your system. d. Disable Autorun: Turn off Autorun to prevent malware from automatically executing when external devices are connected. e. Enable Controlled Folder Access: This feature in Windows Defender will help protect important folders from unauthorized changes. f. Windows Updates: Configure automatic updates to ensure your system is always up-to-date with the latest security patches. g. Disable unnecessary services: Reduce your system's attack surface by disabling services you don't need. h. Configure Group Policy: Use the Group Policy Management Console (GPMC) to enforce security policies and settings throughout your system. i. Configure AppLocker: Use AppLocker to restrict the execution of unauthorized software on your system. j. Network security: Configure your network settings to use a secure DNS provider and set up a VPN for secure browsing on public Wi-Fi networks.
3. Additional Configuration: a. Regularly update all installed software: Make sure to keep all your installed software up-to-date to prevent potential security risks. b. Backup your data: Regularly back up your important files to an external drive or cloud storage to prevent data loss. c. Educate yourself and your employees: Stay informed about security best practices and train your employees to follow them.

These are just a few recommendations for enhancing the security of your laptop running Windows 10 Enterprise. Your specific security requirements might vary based on your use case and the sensitivity of the data you work with.

The security software part is IMO not the best advice.
Malwarebytes is not so great nowadays, could be used as a second opinion scanner, but Norton Power Eraser and Kaspersky Virus Removal Tool are much better for that purpose.
1Password or LastPass, after all the hacks that occurred with LastPass I would change that recommendation to 1Password or Bitwarden.
EDIT: and why advice on configuring Windows Defender when they use F-Secure?

 

[Jonny Quest]

The security software part is IMO not the best advice.
Malwarebytes is not so great nowadays, could be used as a second opinion scanner, but Norton Power Eraser and Kaspersky Virus Removal Tool are much better for that purpose.
1Password or LastPass, after all the hacks that occurred with LastPass I would change that recommendation to 1Password or Bitwarden.
EDIT: and why advice on configuring Windows Defender when they use F-Secure?

Great post I know you can't cover all the second-opinion scanners, but is EEK still a good option, as I tend to like that one?

 

[Gandalf_The_Grey]

Great post I know you can't cover all the second-opinion scanners, but is EEK still a good option, as I tend to like that one?

If you look at the testing done by @cruelsister there are only 2 good ones: NPE and KVRT.

App Review - Second Opinion Scanners- Part 1

Tested are Malwarebytes (free), Sophos Scan & Clean (a free version of HitManPro), and Emsisoft Emergency Kit against a couple of malware files with common dropping and persistence techniques.

malwaretips.com

App Review - Second Opinion Scanners Part 2

Although the video is quite a bit longer than I wanted, I felt it necessary for a proper overview. Also, F-Secure Online Scanner is not included, but will be covered sometime next week.

malwaretips.com

App Review - Second Opinion Scanners: F Secure

malwaretips.com

And the discussion here:

Best Second opinion scanners

Hello guys. I know many of you use second opinion scanners speciality the testers at MT hub. What is the best scanner that you have used?

malwaretips.com

MalwareTips HUB requirements:

On-Demand scan " Second Opinion Scanner " ( SOS ) : required at the end of the test after OS reboot, to better show the final system status as Protected or Infected. To be consistent with other testers and results, testers must use at least two SOS. Norton PowerEraser ( NPE ) AND Kaspersky ( KVRT, add also C:\Users\ + C:\ProgramData\ ). Testers are always welcome to use additional scanners if wanted or needed. Example: EEK ( EmsiSoft ) or HMP ( Sophos HitmanPro ) etc. Zemana is from now on deprecated from the Hub.

https://malwaretips.com/threads/must-read-the-malware-hub-rules.109765/

Personally, I also use AdwCleaner to check on laptops from family members and friends that I support.
IMO those 3 are enough.

 

[HarborFront]

Regarding i)

i. Configure AppLocker: Use AppLocker to restrict the execution of unauthorized software on your system

Please look at the PROS and CONS in using AppLocker below

AppLocker Pros, Cons, and Alternatives

In this article we will discuss what is AppLocker for Windows, pros, cones and the alternatives of this application.

blog.netwrix.com

 

[HarborFront]

One more thing

e. Enable Controlled Folder Access: This feature in Windows Defender will help protect important folders from unauthorized changes.

If I'm not wrong CFA requires MS Defender to be enabled which means you have 3 AVs running in real time ie F-Secure, Malwarebytes and MS Defender. Is that good?

Some AV have this protected folder feature which you can specify to add file-types to protect so CFA (and MS Defender) is not required. And the blocked/allowed app feature in AV works similarly in whitelisting apps to run, like in AppLocker.

Since you have Windows Enterprise I would suggest you make full use of its GPO and configure MS Defender to the max + CFA + AppLocker + disabling USB port access etc