Advanced Plus Security security123's Security Config 2020

[ForgottenSeer 85179]

Yesterday i made another change which i test and i don't revert it now:

Before, i was using KeePass 2 with password & key file but key file was only on another internal hard drive then the database. Not very secure
Then (some weeks now), i move the key file to secure tresor from OneDrive which need your 2FA every time you unlock it. While that's pretty secure, it was real annoying.
So now i use that awesome solution:
- database protected with password & key file - which is only saved on (normal) OneDrive which don't need every time the 2FA token
- KeePass is upgraded with WinHelloUnlock plugin so KeePass can use (locally) Windows Hello and encrypt the database password securely in Windows Password Vault

So a attacker now need:

• Have access to the Windows Password Vault
• Have access to the Cryptographic Key Windows used
• Be able to Cryptographically sign the Cryptographic Key with Windows Hello
• Have access to my OneDrive which is of course maximum secured

And the best:
i only need to enter my Windows Hello credentials and that's it. KeePass unlocked.
Of course i need internet access, as the key file is still used and required for unlocking.

 

[blackice]

Of course i need internet access, as the key file is still used and required for unlocking.

I’ve considered this issue many times and pretty much always come to the conclusion I won’t really be needing logins anyway if I don’t have internet access.

 

[ForgottenSeer 85179]

Thanks to SearchLight i enable now running Windows Defender in its own Sandbox
See Windows Defender Antivirus can now run in a sandbox - Microsoft Security

Also in ConfigureDefender i enable "LSASS" protection and also "Shell Extension Security" in Hard_Configurator.

Beside that, i own now a Nitrokey FIDO2 key but sadly only few sites (Microsoft for example) support FIDO2. Sadly also Windows itself doesn't support FIDO2 locally and only over Intune which isn't a option for us privat user's.
Also i change/ correct my config overview a little bit.

 

[ErzCrz]

Thanks to SearchLight i enable now running Windows Defender in its own Sandbox
See Windows Defender Antivirus can now run in a sandbox - Microsoft Security

Also in ConfigureDefender i enable "LSASS" protection and also "Shell Extension Security" in Hard_Configurator.

Beside that, i own now a Nitrokey FIDO2 key but sadly only few sites (Microsoft for example) support FIDO2. Sadly also Windows itself doesn't support FIDO2 locally and only over Intune which isn't a option for us privat user's.
Also i change/ correct my config overview a little bit.

I like the idea of WD running in sandbox. Is this capable in Win 10 Home version? I should look into enabling LSASS and Shell extension when I get a minute.

 

[ForgottenSeer 85179]

Is this capable in Windows 10 Home version?

I would say yes. Just try it and verify the AppContainer process in ProcessExplorer tool

 

[ErzCrz]

I would say yes. Just try it and verify the AppContainer process in ProcessExplorer tool

I think I manged to get it working. Antimalware Service executable Content Process MsMpengcp.exe now showing after using the coding in admin powershell. Time to look at the other two options you've done in CD.

 

[ForgottenSeer 85179]

Today i enable another Hard_Configurator config:
In "Designated File Types" i add the "Paranoid Extensions" but remove PS1, PS2, PSC1, PSC2, PS1XML, and PS2XML extensions as it's recommend in manual if <Block PowerShell Scripts> is set to ‘ON’.

Paranoid Extensions include extended number of potentially dangerous file extensions (over 250 entries), which were abused in the wild to exploit Windows or MS Office. It can be used to protect casual users.

 

[Ink]

Malware-pr00f

 

[ForgottenSeer 85179]

Because of problems with "Memory Integrity" (called HVCI) between Defender Network Protection i disable it for now which also disable Device Guard:

Windows Defender network inspection service fails to start

Windows Defender network inspection service fails to start as reported here: https://www.tenforums.com/antivirus-firewalls-system-security/161859-windows-defender-network-inspection-service-fails-start.html. I have the first two error codes showing. The immediate solution is to disable Memory...

malwaretips.com

(Credential Guard is still enabled)

 

[ForgottenSeer 85179]

Thanks to Lenny_Fox i moved Top3000 list from AdGuard extension to Edge for better internal handling.

 

[ForgottenSeer 85179]

Yesterday I removed TinyWall as I don't use any program which need blocked network access.

I also get some problems in past with e.g. Defender updates because of silently blocked.

So now I'm using default Windows firewall with Andy's recommend firewall rules. As my setup is more then strong enough I don't need fear anything.

 

[ErzCrz]

Yesterday I removed TinyWall as I don't use any program which need blocked network access.

I also get some problems in past with e.g. Defender updates because of silently blocked.

So now I'm using default Windows firewall with Andy's recommend firewall rules. As my setup is more then strong enough I don't need fear anything.

Great setup. I should see about implementing some of your tweaks

 

[ErzCrz]

With regards to Keepass. Do you use a browser extension along with it or just do the auto-type from the desktop app itself?

 

[ForgottenSeer 85179]

With regards to Keepass. Do you use a browser extension along with it or just do the auto-type from the desktop app itself?

I only use the auto-type from the desktop program itself

 

[ErzCrz]

I only use the auto-type from the desktop program itself

Cool, thanks

 

[ForgottenSeer 85179]

In Edge i set these two flags back to default:
enable-webrtc-hide-local-ips-with-mdns enable-lazy-image-loading

I don't get any improvements with restricting WebRTC.
Same for lazy image loading as i own a 250+ VDSL connection (but still use lazy frame loading)

 

[ForgottenSeer 85179]

No change, but today i run different "Periodic scanners":

Hitman Pro:


MalwareBytes Anti-Rootkit:


MalwareBytes:


EEK:


I also run NPE (Norton Power Eraser) and while the "suspicious" scan doesn't found anything the normal scan think that a restricted script execution (thanks to Andy!) is malicious. In my opinion a fatal false positive.
Also i try running Adwcleaner from MalwareBytes but for some reason it doesn't start.

I guess i can say that my system is clean
(both Autoruns & Process Explorer with enabled Virustotal scanning also reporting nothing bad)

 

[Ink]

Have you considered using a Linux distro?

 

[Dave Russo]

Not really, with WD + H_C. You can try it to see how Edge performs with it.

Application guard seems to be a real resource hog(at least on my computer) have you notice this?,Good guestion is it really worth using???

 

[ForgottenSeer 85179]

Have you considered using a Linux distro?

No as Linux doesn't provide me any advantage but many disadvantages.

Application guard seems to be a real resource hog(at least on my computer) have you notice this?,Good guestion is it really worth using???

It is definitely worth if you care about security and want a special isolated Edge. I use it sometimes for sites i doesn't trust, like watching ****
Sure that use some resources but nowadays PC are powerful enough. But yes, i notice it