Basic Security Valvaris Security Config 2019

Last updated
Dec 23, 2019
Windows Edition
Enterprise
Security updates
Allow security updates and latest features
User Access Control
Always notify
Real-time security
Sophos Home Premium
Firewall security
Periodic malware scanners
Sophos Clean
Malware sample testing
I do not participate in malware testing
Browser(s) and extensions
Microsoft Edge Chromium
Maintenance tools
Windows Build-In
File and Photo backup
OneDrive and OneDrive Vault
System recovery
Not needed since all settings are saved with Microsoft Account. Easy install Win10 get a few apps, drivers and done...
Risk factors
    • Gaming
    • Browsing to popular websites
Computer specs
Self-Build
i7 8700K
RTX 2070 Super
3200 MHz Corsair Vengeance LPX 16CL
M2 Nvme Samsung 960 Evo 500GB
HX1000W Corsair
ASUS ROG Maximus XI Hero Z390
ASUS Essence STX II Soundcard
ASUS ROG PG278Q G-Sync

valvaris

Level 6
Thread author
Verified
Well-known
Jul 26, 2015
263
Why the config in that way?
As a Application Firewall I use GlassWire and Block Apps that are very talkative. ;)
The next line of defense is my Security Appliance - Sophos XG Home (HW-Firewall) and isolated my IoT devices.
Example:
Network.png

The Network is build in segments:
192.168.x.x /24 for Smart-TV, IoT and Mobile-Devices
172.16.x.x /30 for my PC
The Managed-SW has a ACL build in and backed my trusted devices in to it. Like that the Ports on it only communicate with those devices.
My Router is a simple AVM-Cable Router and have configured that my my Firewall (XG) as a Exposed-Host like that I do not get double NATed. :)
Otherwise all other Ports are closed.

Why the XG?
Is very simple it has DPI HTTPs inspection build-in and scans SSL Traffic for Certificates and Malware with a double engine. (Sophos and Avira) The other upside is IPS (Snort) and many other Security features for free...
Test site for Sophos XG features test -> Sophos Web Security and Control Test Site

START ------------------------------------>>> OLD CONFIG <<<---------------------------------------- START
Then why a Pi-Hole?
To block sites at a DNS Level with RegEx entrys and Blocklists provided by The Block List Project and other projects.
I know my DNS query is quite long but it is more secure (My opinion)
Example:
PC ----> XG ----> Pi-Hole ----> Quad9 Filtered/DNS-Sec
IoT ----> Pi-Hole ----> Quad9 Filtered/DNS-Sec
END ------------------------------------>>> OLD CONFIG <<<---------------------------------------- END

NEW Config Setup Update 25.12.2019


What changed?
The Pi-Hole DNS Server Adblocker is gone and has been replaced with eBlocker! (Open-Source)

Why has it been changed?
Have to say the Pi-hole is a great project but I was in the search to offload advanced tracking protection and blocking of various ads. Adguard is a great project as well (Desktop and Browser Extension) but still I wanted to streamline that level of protection to my whole network.

What was my solution?
I switched from the Pi-hole project to eBlocker that is available now over at: eBlockerOS Download - eBlocker Open Source - Free Privacy & Parental Controls Gateway

What does eBlocker do?
- HTTPS Decryption
- Easylist Pattern File Compatible
- Domain Blocklist Compatible
- Squid ACL Compatible
- Parental Controls
- Network wide protection
- DNS Level Domain blocking
- and lots more...

How complicated was it to setup?
5min. install and final fine-tuning max. 30min. with custom lists.

Cert. flow for the XG?
External Site SSL ----> eBlocker ----> XG -----> PC
All I needed to do is to import the cert. from eBlocker to my XG CA Store and done.

Compatibility self-tested:
- PC = Full HTTPs
- iOS = Full HTTPs (Cert. Import from local eBlocker appliance)
- Android-TV = Limited (because Nvidia Shield does not support import from certificates)
- Ubuntu = Full HTTPs (Cert. Import from local eBlocker appliance) since it is in front of the Firewall appliance. ^^
- SMART TV = Limited (Samsung old TV does not support import of certificates to decrypt HTTPs Traffic)

OK OK but why not do a Backup of your OS?
It is just a blank Windows 10 Ent. install with a few Privacy Settings here and there... Connected to my Microsoft Account and all my data is in OneDrive / Important stuff in OneDrive Vault! - For me it is just insert USB - Click thru the Setup, Install a few Drivers and Connect my Account. Done! Since I have a 1Gbit connection downloading games is a matter of min. ^^

If someone has questions or improvement options I am all ears. :D I am not perfect and open to critique ^^

Sincerely
Val.
 
Last edited:

harlan4096

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Apr 28, 2015
8,635
@valvaris:
  • As for "Disk Imaging Backup", You may add Macrium Reflect Free.
  • As for "Virus and Malware Removal Tools", You may add: MalWareBytes Free and EmsiSoft Emergengy Kit
Please kindly reflect Your changes editing Your config, and announcing them here, thanks for sharing :giggle:
 

valvaris

Level 6
Thread author
Verified
Well-known
Jul 26, 2015
263
Hello @harlan4096
For a Disk-image Backup even in Golden-State is too much of an effort. ;) [Only on my Setup] - I do not have local files and since all game-saves are saved on the cloud - [Steam,Origin,GoG and EpicLauncher] I do not feel the need for it.
If I need to do Excel-Sheets, Word and so on -> I use Office 365 for it Autosave FTW on the Cloud ^^
I am sorry for not being clear about my Firewall Setup:
- HTTPs Inspection Rules all Traffic gets decrypted on the FW and if OK gets forwarded to my PC that has a certificate installed from my Firewall like this it is trusted on my browser.
- My Webfilter Rules are harsh plus the added advantage of Pi-Hole filters and block Executables and Systemfiles
- The other Part is that my Rules Block untrusted TLS/SSL Cert. or TLS/SSL Cert. that use a low encryption algorithm or standard.
What my goal was is to offload as much as I can to the FW-Appliance. :D
Second Opinion Scanner?! Is a little too much on my opinion -> Why?
That is the reason I use Sophos Home Premium:
- Hitman Pro + Hitman Alert and more - All in One
and of course Windows Build In Smart Screen and user behavior ;)
Back to the Backup topic:
Is it not easier to make backups an a weekly basis that contains the drivers and such... In one way YES in another NO
For me it is easier to maintain my boot usb with current drivers. (download files - install on current system awww... broken install from usb with last drivers done!) Like this my usb drive always has the last drivers that worked well with the system and it is just a drag and drop. Even with Incremental backups you have to make sure that all incrementals to that point of failure are consistent! And with no external storage HDD/SSD or NAS the other way can be cloud but with 50Mbit/s upload - I do not see a reason for that. ^^
The Windows installation is fast and easy and the OOBE lets me connect fast to my Microsoft Account and Sync files. I not always need everything and since it is possible to setup OneDrive as Files-On-Demand you save huge bandwidth.

Thanks allot for your advice!!! Gave me the opportunity to clarify why it is how it is.

Sincerely
Val.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top