Intro
I have been receiving many PMs about security and protecting machines in general. I decided to make this thread which is aimed for users who know a little bit about windows and are not afraid to "break" anything.
In here i will introduce advanced security to protect your PC from physical and remote unauthorized access (also good for parents for parental control).
The guide is aimed for Windows XP, Vista and Seven.
What Are We Going To Achive
1) BIOS protection.
2) Windows account security and protection.
3) Application execution control.
4) General Security and control over windows.
5) Full disk encryption
What Do We Need
1) Full administrative access to windows and BIOS.
2)
COMODO Internet Security.
3) Some knowledge about windows and BIOS.
4)
TrueCrypt
Advanced Security Setup
Step 1
Gain access to your BIOS settings. How to do it is different on each machine, most of the time when starting up your PC you will see what button to press to gain access to BIOS settings. When you have established BIOS access, search for "Boot Order" and change it to boot from HDD first, by default it should be to boot from CD/DVD first. Also put a password on your BIOS Settings
Explanation:
This is required so that no one can boot anything from any CD/DVD that might contain contect which is able to let someone access your files or modify data on your HDD.
Step 2
Open "RUN" dialog box under windows and type in "lusrmgr.msc". From the left pane, click "Users". There is a hidden or disabled built-in Administrator account in every windows, if it's disabled, it's fine, but still you want to password protect it. To do that, double click on the built-in Administrator account and untick "Password Never Expires" and then tick "User Must Change Password At Next Logon", after that untick "Account Is Disabled". Reboot your PC and log into your built-in Administrator account, set password to it, log out and disable the built-in Administrator account again.
Explanation:
This is required in case someone manages to enable that account and get a login form, if it's password protected, the person can't log in.
If you ever need to reset a password on any windows account, use this tool here.
Step 3
This can be skipped, but it's recommended to have. Make a password protected administrator account under windows, but don't start using it as a regular account. Make another account where you have Standard User rights and if you ever need to install anything or gain access to places which need administrator rights, you can simply use that account by entering a password and make the actions which require administrator privileges.
Explanation:
This is suggested to prevent major damage done to your system by someone who has physical or remote access over your PC.
Step 4
Download and install COMODO Internet Security. Durign the setup, i suggest you to not include "Geek Buddy".
Explanation:
We are going to use COMODO as an application layer security module which does not require much administration or care later on.
Step 5
Download and install TrueCrypt. I would recommend you to do the full system encryption and to require a password at each boot. If you do not wish to fully encrypt your drive, make a container file for your sensitive information. TrueCrypt is now pretty safe to use, even when you experience BSOD's, power cuts or any other sudden shutdowns, read more about it under TrueCrypts FAQ.
There is no notable performance loss when having the drive fully encrypted. Make sure to not cache TrueCrypts passwords as then they are stored on the disk or in the memory where they can be potentially accessed. Make sure to completely shut down your PC when you are not using it and are away from it. When it is sleeping or hibernating a cold boot attack could potentially be executed, thus extracting the encryption keys. Make sure you will have TrueCrypts rescue disk and just in case make a backup of that disc.
I would strongly recommend you to read ALL of TrueCrypt FAQ, it will come helpful in the long run and therefore i don't need to cover all the steps and tips here in this thread which would just make the thread longer.
Explanation:
This is suggested to prevent access to your data from unwanted sources.
COMODO Setup As An Application Layer Security Module
After installing COMODO and updating the AV database, some configuration is needed. First of all, right click on COMODO tray icon and choose Configuration > Proactive Security. After that follow with the settings below.
Settings Under "Antivirus"
Scheduled Scans > Remove or make a scheduled scan.
Scanner Settings >
Realt-Time Scanning TAB >
Real-time scanning > On Access
Tick > Scan memory on start, Automatically update virus database, Automatically quarantine threats found during scanning, Show alerts/notification messages.
Heuristics scanning level > Medium
Do not scan files larger than (MB) > 50 MB
Manual Scanning TAB >
Tick > Scan memory on start, Scan archive files, Automatically update the virus database before scanning, Enable cloud scanning, Enable rootkit scanning
Untick > Submit unknown files for analysis (this is optional, if you have enough bandwidth to spare then enable this one)
Heuristics scanning level > Medium
Do not scan files larger than (MB) > 50 MB
Scheduled Scanning TAB >
Tick > Scan memory on start, Scan archive files, Automatically quarantine threats found during scanning, Automatically update the virus database before scanning, Show scanning progress, Enable cloud scanning, Enable rootkit scanning.
Untick > Submit unknown files for analysis (this is optional, if you have enough bandwidth to spare then enable this one)
Heuristics scanning level > Medium
Do not scan files larger than (MB) > 50 MB
Settings Under "Firewall"
Stealth Ports Wizard >
Alert me incoming connections and make my ports stealth on a per-case basis
Firewall Behavior Settings >
General Settings TAB >
Firewall Security level > Safe mode
Alert Settings TAB >
Alert Frequency Level > Medium
Tick > Every option under this tab
Advanced TAB >
Only tick > Block fragmented IP datagrams
Settings Under "Defence+"
Defence+ Settings >
General Settings TAB >
Defence+ Security Level > Safe Mode
Tick only > Enable adaptive mode under low system resources
Execution Control Settings TAB >
Execution Control Level > Enabled
Tick and set > Treat unrecognized files as > Restricted
Tick everything else
Sandbox Settings TAB
Sandbox Security Level > Enabled
Tick > Every option under this tab
Monitoring Settings TAB
Tick > Every option under this tab
Settings Under "More"
Preferences >
General TAB >
Tick > Automatically check for program updates, Automatically detect new private networks
Untick > Show balloon messages, Enable COMODO message center, Show traffic animation in the tray
Parental Control TAB >
Tick > Every option under this tab
Set a strong password in there
Appearance TAB >
Choose a theme for your liking
Update TAB >
Tick > download.comodo.com
What Next
After configuring COMODO as an application layer security module, you then need to know whats going to happen and how to use your system.
Your systems security is now quite strong, unknown applications with default privileges (under standard user rights if you made the step 3) will be ran in a sandbox with restricted access to system resources, most unknown applications will not start or will crash. If you didn't go with Step 3, applications are still going to run under restricted access. Your computers ports are hidden and majority attacks will be blocked sophistically.
If you need to install a new application then most of the times you need to disable COMODOs Parental Control settings, install the application, make some changes to Defence+ Security Policy if needed and re-enable the Parental Control.
Please note that if your PC is not as much for public use, you can skip COMODOs parental control part, so it would be easier for you to manage configurations etc.
Make sure you allow trusted software under COMODOs sandbox to run fully, not with restricted access, to do that simply pick an application from the list and choose the option from the right Move To > Trusted Files.
These are some settings and tips what you should look after for, for more information, COMODO offers excellent Help menus under each option menu called "What do these settings do?" click it to get more information.
Hope this guide helps someone, if you have questions post them here or PM me.
Stay safe.
My Related Threads:
Windows Application Layer Security
EMET (Enhanced Mitigation Experience Toolkit)
Deja Vu
