Advanced Plus Security security123's Security Config 2020

[ForgottenSeer 85179]

Finally i can post my config as i use the new Windows 2004er build as clean base.
My setup is for minimum attack surface.
Also as Firewall i use TinyWall which works together/ beside Windows Firewall enabled

Chromium-Flags: Microsoft Edge - Chromium-Edge Flags
Anti-Exploit settings for Edge: Guide to Tweak of built-in Exploit protection in Windows Security
Anti-Exploit settings for Adobe Touch PDF reader: Update - Hard_Configurator - Windows Hardening Configurator


My plans for future:
- replace Windows Hello pin with Nitrokey FIDO2 key -> not possible for home user
- maybe adding Anti-Ransomware protection -> done
- replace Ryzen 5-2600 with Ryzen 5-4000er serie for more hardware security features
- maybe replace Personal Backup 6

 

[ForgottenSeer 85179]

Maybe someone can answer this:
Is Microsoft Defender Application Guard needed for my setup?

 

[Ink]

For Backup, what are "Windows internal"?

According to the Windows 10 support page, there are 3 different methods;

• Cloud-based with Microsoft OneDrive
• External or Network Drive with File History
• Legacy (Backup and Restore (Windows 7))

For Maintenance, what are the "internal" called, Storage Sense, Legacy Windows Disk Cleaner?

maybe adding Anti-Ransomware protection

You can try Controlled Folder Access for free, or buy a Microsoft 365 subscription - review benefits, annual payment is cheapest:

• Microsoft 365 advanced protection
• Ransomware detection and recovering your files
• Many other benefits including Desktop Office with Free Upgrades, 1TB Cloud Storage, Personal Vault and more.

There may be other Free and Paid Ransomware Tools available online.

 

[ForgottenSeer 85179]

For Backup, what are "Windows internal"?

According to the Windows 10 support page, there are 3 different methods;

• Cloud-based with Microsoft OneDrive
• External or Network Drive with File History
• Legacy (Backup and Restore (Windows 7)

I use File History to Network Drive

For Maintenance, what are the "internal" called, Storage Sense, Legacy Windows Disk Cleaner?

Yes. Also "sfc" and "dism" command.

You can try Controlled Folder Access for free, or buy a Microsoft 365 subscription - review benefits, annual payment is cheapest:

• Microsoft 365 advanced protection
• Ransomware detection and recovering your files
• Many other benefits including Desktop Office with Free Upgrades, 1TB Cloud Storage, Personal Vault and more.

Yeah i know it, but in past it create a lot of false positives on my system. Even for Windows own processes.
With H_C from Andy a infection chance is very low. (I use SRP before too)

 

[Ink]

Maybe someone can answer this:
Is Microsoft Defender Application Guard needed for my setup?

Try it out for a few days.

 

[oldschool]

Maybe someone can answer this:
Is Microsoft Defender Application Guard needed for my setup?

Not really, with WD + H_C. You can try it to see how Edge performs with it.

 

[ForgottenSeer 85179]

New stuff:
- In Defender - Exploit protection i enable/ enforce Dynamic ASLR
- change the inactivity limit to 15 minutes: The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
- change Data Execution Prevention (DEP) to AlwaysOn / enforcing: Data Execution Prevention (DEP) must be configured to at least OptOut.

 

[ForgottenSeer 85179]

Today i enable Anti-Ransomware protection in Microsoft Defender and also install Microsoft Application Guard.

Also i update Hard_Configurator to new 5.1.1.2 and TinyWall to new 3.0.6 version.

 

[ForgottenSeer 85179]

Since the company of my router released the new update today, i was able to enter encrypted DNS (DoT) directly into the router.

I use NextDNS now on all devices - without any need more for my PiHole

 

[Brahman]

Since the company of my router released the new update today, i was able to enter encrypted DNS (DoT) directly into the router.

I use NextDNS now on all devices - without any need more for my PiHole

Which router do you have?

 

[ForgottenSeer 85179]

Which router do you have?

AVM FritzBox 7590

 

[Brahman]

AVM FritzBox 7590

Wow that's a costly piece of hardware..

 

[ForgottenSeer 85179]

Wow that's a costly piece of hardware..

Not the cheapest one but best product from Germany. Very secure router with good support

I can only recommend their products. With latest update they now support non-German languages!

Also I get it for free from my company

 

[Brahman]

Not the cheapest one but best product from Germany. Very secure router with good support

I can only recommend their products. With latest update they now support non-German languages!

Also I get it for free from my company

lucky you.

 

[LDogg]

Good setup thanks for sharing.

~LDogg

 

[Ink]

On Mobile, it's all Pro-privacy.
On Desktop, it's just Meh-privacy.

Where do you draw the line between being Pro-privacy and then using proprietary Windows 10 software?

 

[ForgottenSeer 85179]

On Mobile, it's all Pro-privacy.
On Desktop, it's just Meh-privacy.

Where do you draw the line between being Pro-privacy and then using proprietary Windows 10 software?

Windows 10 does a great step forward for privacy with e.g. App permission management like Android/ iOS.
Windows 10 has great security features which protect user privacy in the end. Also you can configure Windows to not sending personal (meta-)data.

But yes, smartphones are best choice for both security and privacy

 

[Vitali Ortzi]

The config you made did lower the attack surface a lot compared to a regular user

 

[ForgottenSeer 85179]

Today i change Edge settings to not removing any more Cookies & Site Data on browser exit.
2 reasons:

- i don't like the ~2 seconds longer exit time
- i remove site data manually anyway which i don't need (after closing site) so doing it automatically is redundant

 

[oldschool]

Today i change Edge settings to not removing any more Cookies & Site Data on browser exit.
2 reasons:

- i don't like the ~2 seconds longer exit time
- i remove site data manually anyway which i don't need (after closing site) so doing it automatically is redundant

I've already done the same and I use Shft+Ctrl+delete when I want the shotgun approach.