Advanced Plus Security Parsh's security config 2020

[Parsh]

Kaspersky free + Comodo Firewall at restrictive settings had been my baseline for a year. I used to find peace in using virtualization, isolation and default-deny at the cost of experience.
Now, less of managing sandboxing FPs and rule issues of Comodo. I've shifted the paradigm to lesser real-time programs, more hardening, more ease of using PC as a user normally would (with occasional alerts). Balance. Now my mains are ESET + OSArmor.

I chose ESET since I'd never evaluated its features properly. It's light for real, provides a fairly customizable HIPS with many intuitive options. Some downsides I noticed --

• ESET HIPS 'Ask' alerts auto-allow actions if not responded to within a minute
• ESET is forgiving ... in another way. To reduce the no. of FPs, it sometimes bails suspicious actions it tracked. And this has been re-instantiated here and at ESET forums

Sure, ESET HIPS will have its own shortcomings due to its design. Same is the case for any such solution.
For that, I've tried to reduce the attack surfaces so that ESET has little work to do. And then, managing some FW events and one-time HIPS rules.
I've spent the last week experimenting with HIPS and learning good and bad rules (this goes on). I would recommend HIPS to be set at least to 'Smart' Mode instead of 'Automatic', to be alerted very occasionally about suspicious activities.

My other configurations are as below

Spoiler: OS hardening

1. Unnecessary and risky Program Features disabled
2. Unnecessary services disabled
3. Unnecessary network protocols and provisions disabled via Network & Sharing Centre
4. Distributed and remote access COM universally off
5. Scripts execution universally OFF
6. Remote assistance provisions OFF
7. UAC at Always Notify + UAC bypass hardening as found in OSArmor
8. Further restrictions using majority of SysHardener and OSArmor settings (+custom rules)
9. Local Security policy changes
   1. network access - do not allow storage of credentials
   2. UAC Admin Approval Mode
   3. enter log-on screen only via Ctrl+Alt+Delete (to counter a fake screen)
10. SecureBoot ON
11. Smartscreen everywhere
12. Core isolation > Memory Integrity ON (zemana has a problem with this fella)
13. WD periodic scanning ON
14. Hardening of browser using some flags
15. WD Exploit protection settings for Edge (only a few, to not break regular browsing)

Spoiler: Other practices

1. Hyper-V VM for an isolated environment
2. Restriction of R/W permissions over some important data, applicable to other users
3. Using sandbox for running doubtful programs / Edge with WD App Guard for safe browsing
4. Using NVT checksum tool to verify installers
5. Updating OS + apps regularly
6. Using alternatives to some popular 3rd party programs
7. Password-protecting important data sent via mails
8. Periodic checkup of online accounts
   1. Privacy settings
   2. 2FA
   3. 3rd party app access checks

Spoiler: Tentative To-do list

1. Experiment with Reg Guard & MemProtect (memory protection, indirect DLL blocking)
2. Experiment to see if SRP/AppLocker ... would be practical for my needs. I often install software and libraries etc w.r.t. testing and programming - using extreme lockdown is a tough job
3. Comprehensively add more LOLBAS LOLbins and some DLL-driven bypasses to blacklist using a program with such support

 

[Sampei Nihira]

Just one note.
No flags for browsers?
No Command Line Switches?

 

[Parsh]

Just one note.
No flags for browsers?
No Command Line Switches?

I edited the post. I'm using several flags for security and privacy. Just not the strict-origin-isolation among the popular ones. It often breaks things.
AppContainer flag (not the GPU one) is not available anymore and I read that it's default. Couldn't verify using PE/PH though.
I wonder where would I benefit from using Command line switches. Do you use any?

 

[oldschool]

I think OSA is overkill, especially in light of your knowledge and experience.

 

[Sampei Nihira]

I edited the post. I'm using several flags for security and privacy. Just not the strict-origin-isolation among the popular ones. It often breaks things.
AppContainer flag (not the GPU one) is not available anymore and I read that it's default. Couldn't verify using PE/PH though.
I wonder where would I benefit from using Command line switches. Do you use any?

--ssl-version-min=tls1.2 -cipher-suite-blacklist=0x002F,0x0035,0x000A,0x009C,0xC014,0x009D

Yes, but in Chrome on my daughter's pc.
--ssl-version-min = tls1.2 also works in Chromium/Edge
The other that eliminates almost all the insecure cipher suites doesn't work.

Test at the link below:

SSL/TLS Client Test - TLS Fingerprinting

Check your browser's supported TLS protocols, cipher suites, TLS extensions, and key exchange groups. Identify weak or insecure options, generate a JA3 TLS fingerprint, and test how the browser handles insecure mixed content.

browserleaks.com

 

[SeriousHoax]

This is a very harden setup. I agree with oldschool. With all your custom HIPS rules you don't really need OSA I think.

ESET HIPS 'Ask' alerts auto-allow actions if not responded within a minute

This can be countered by changing notification settings. Change the timeout value to never.

 

[Parsh]

I think OSA is overkill, especially in light of your knowledge and experience.

I feel that a well-configured SRP / isolation / default-deny setup is required besides an AV. That's an important defense I've learnt from here. Safe habits do reduce chances of attack. However, a user like me who's using and allowing quite some 3rd party apps, libraries and surfing the web avidly without total isolation,.. that makes one vulnerable.
ESET even with hardened settings, has limitations in the scope of monitoring restricted files, among other limitations.
Also, with AVs like ESET, you cannot achieve many restrictions that you can impose on the system using OSA, I'm sure you'll agree with that.
OSA is helpful in reduce the attack surface (further than the ESET HIPS I configured with my limited knowledge and with ESET HIPS' limitation based on design) with the extensive blocking options that Andreas has compiled, and I can also add system-wide process and commandline blacklists to OSA

 

[Parsh]

--ssl-version-min=tls1.2 -cipher-suite-blacklist=0x002F,0x0035,0x000A,0x009C,0xC014,0x009D
Yes, but in Chrome on my daughter's pc.
--ssl-version-min = tls1.2 also works in Chromium/Edge
The other that eliminates almost all the insecure cipher suites doesn't work.

Test at the link below:

SSL/TLS Client Test - TLS Fingerprinting

Check your browser's supported TLS protocols, cipher suites, TLS extensions, and key exchange groups. Identify weak or insecure options, generate a JA3 TLS fingerprint, and test how the browser handles insecure mixed content.

browserleaks.com

I see. It's in relation to How to disable Chrome Browser Bundled MITM backdoor?.
Interesting, will check it. Thanks.

This can be countered by changing notification settings. Change the timeout value to never.

The alert and the notification are different. I could find only the 'Desktop Notification' timeout option and it just displays 'allowed' or 'blocked'. It's not meant to adjust timeout of the alert window that asks for user action. Let me know if I'm missing something.

 

[Sampei Nihira]

I see. It's in relation to How to disable Chrome Browser Bundled MITM backdoor?.
Interesting, will check it. Thanks.

Yes.
Only that I brought it to attention a year before that 3D.

 

[SeriousHoax]

The alert and the notification are different. I could find only the 'Desktop Notification' timeout option and it just displays 'allowed' or 'blocked'. It's not meant to adjust timeout of the alert window that asks for user action. Let me know if I'm missing something.

I was a bit wrong with my description. Turn this option off like this. That does the trick for HIPS alert as well.

 

[Parsh]

I was a bit wrong with my description. Turn this option off like this. That does the trick for HIPS alert as well.
View attachment 234560

I have this disabled already. Still, the action is automatically taken if I do not input mine within a minute.
It's apparently designed that way for system stability, as the ESET forum admin has indicated.

 

[SeriousHoax]

I have this disabled already. Still, the action is automatically taken if I do not input mine within a minute.
It's apparently designed that way for system stability, as the ESET forum admin has indicated.

 

[Parsh]

Had a system corruption yesterday. Restoring the last backup from EaseUS Todo was a task!
The backup was on an external HDD password-protected by WesternDigital Security app. I tried removing the password on my cousin's computer. WD Discovery app detected the HDD but failed to remove the password. WD Security app failed to detect the HDD at all.
So I was left with one option, restore back to an older Windows-made System Image (C-drive) with just ESET and OSA.
After recovery, I could finally unlock the HDD on my laptop. Then, I chose to restore system using the newer image made by EaseUS Todo Backup. Did that and the system felt quite sluggish.
Hence, I went on to again restore the Windows-made system image (C-drive)(1) and this time, the recovery wizard indicated that the entire harddisk (C, D, E partitions) need to be wiped to map the partition data contained in the system image. Whaaaaa?

Such things show you that anything can go wrong and what better precautions one might want to take henceforth.
I did it (1). And now the ESET installation had some problem. Good time to test a few other suites I'm eager to... and maybe get back to mine

 

[blackice]

I like the use of OSA! I used it with ESET and I use it with Bitdefender. It's very helpful for covering extra spots.

 

[Parsh]

I like the use of OSA! I used it with ESET and I use it with Bitdefender. It's very helpful for covering extra spots.

Preventing suspicious processes, potentially dangerous actions and widely used attack vectors irrespective of the app reputation. OSA can kick almost any setup up a notch
I have spun up a fully isolated Hyper-V VM with KIS... in an attempt to separate casual and important activities.
I am planning to swap ESET inside the VM. No application control, allow most used apps to run and update on their own without blocks or alerts. Just the lightness, good sigs and policy-based FW along.