What steps do you take to keep both your computer and internet browsing secure?

Question

I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.

Answer 1

I suggest running Win7 inside Win7 using VirtualPC and revert to an original snapshot before and after browsing. I use EMET to lock down Win7 further, and the CIS benchmarks are also worth investigating. Using BitLocker with a TPM chipset board is good not only for confidentiality (using full-disk encryption) but also for file integrity.

Firefox without Flash, Silverlight, or Java installed and running NoScript (but tuned) works nicely for the time period that you will be browsing. If you're going to run Flash (e.g. YouTube or Flash movie) or a Java applet, open Chrome, watch it, and then close out all instances. You should probably use file integrity monitoring on browsers, browser plugins, and common system managed-code VMs such as your JVM, Flash engine, and .NET CLR.

If you have a work connection, avoid VPN and instead use SSL-only Outlook Anywhere (not OWA), use S/MIME encryption at the message level, and additionally store OST's on a BitLocker, Truecrypt, or similar volume. Unless you're a sysadmin and are constantly performing tasks that require a VPN -- don't log into it. It's safer for you and everyone if you just never use the VPN. I might suggest creating a special VM-guest or have a special laptop just for VPN if you do require it. OpenVPN with client-side certs is probably a fairly good VPN solution compared to the commercial offerings, which are all equally bad and promote security theater.

Anti-Virus agents are a waste of time/resources (and probably make you less secure), but it might be a good idea to occasionally scan VM-guests or Host OSes using an outside scanner, and the Symantec one isn't awful for this purpose, although some information I've seen leads me to believe that Kaspersky, Avira, NOD32, Gdata, and Sophos are sometimes superior (see http://av-comparatives.org). There's a lot of security theater here, too.

This is going to sound really crazy for mobile security, but I guess that I suggest getting a (non-GSM, non-iDEN) BlackBerry but setting up your own Windows SBS machine with BES Express (all with CIS-benchmark/etc hardening guidelines to remove things like BlackBerry off-line backup, etc). Probably best to not use your real name on the BES server or the Blackberry, and somehow mask the real names of all of your contacts whenever and however possible (first name, first initial of last name works ok, right?). The alternative here is an iPhone 3GS using the CIS benchmark and the built-in iOS full-disk encryption, S/MIME for mail, don't use full real names, etc, but note that the GSM network is fairly insecure compared to say, the networks of Sprint or Verizon in the US. If you sync the iPhone with iTunes, be very careful to note that iTunes now contains the password to the iPhone.