I am thinking about your browser setup, antivirus protection, vpn, browsing best-practices and so on.


I suggest running Win7 inside Win7 using VirtualPC and revert to an original snapshot before and after browsing. I use EMET to lock down Win7 further, and the CIS benchmarks are also worth investigating. Using BitLocker with a TPM chipset board is good not only for confidentiality (using full-disk encryption) but also for file integrity.

Firefox without Flash, Silverlight, or Java installed and running NoScript (but tuned) works nicely for the time period that you will be browsing. If you're going to run Flash (e.g. YouTube or Flash movie) or a Java applet, open Chrome, watch it, and then close out all instances. You should probably use file integrity monitoring on browsers, browser plugins, and common system managed-code VMs such as your JVM, Flash engine, and .NET CLR.

If you have a work connection, avoid VPN and instead use SSL-only Outlook Anywhere (not OWA), use S/MIME encryption at the message level, and additionally store OST's on a BitLocker, Truecrypt, or similar volume. Unless you're a sysadmin and are constantly performing tasks that require a VPN -- don't log into it. It's safer for you and everyone if you just never use the VPN. I might suggest creating a special VM-guest or have a special laptop just for VPN if you do require it. OpenVPN with client-side certs is probably a fairly good VPN solution compared to the commercial offerings, which are all equally bad and promote security theater.

Anti-Virus agents are a waste of time/resources (and probably make you less secure), but it might be a good idea to occasionally scan VM-guests or Host OSes using an outside scanner, and the Symantec one isn't awful for this purpose, although some information I've seen leads me to believe that Kaspersky, Avira, NOD32, Gdata, and Sophos are sometimes superior (see http://av-comparatives.org). There's a lot of security theater here, too.

This is going to sound really crazy for mobile security, but I guess that I suggest getting a (non-GSM, non-iDEN) BlackBerry but setting up your own Windows SBS machine with BES Express (all with CIS-benchmark/etc hardening guidelines to remove things like BlackBerry off-line backup, etc). Probably best to not use your real name on the BES server or the Blackberry, and somehow mask the real names of all of your contacts whenever and however possible (first name, first initial of last name works ok, right?). The alternative here is an iPhone 3GS using the CIS benchmark and the built-in iOS full-disk encryption, S/MIME for mail, don't use full real names, etc, but note that the GSM network is fairly insecure compared to say, the networks of Sprint or Verizon in the US. If you sync the iPhone with iTunes, be very careful to note that iTunes now contains the password to the iPhone.

  • 1
    Why particularly Win7 in Win7? Whilst alternate OS's aren't innately more secure, there's significant benefits to be had by running something less mainstream in the VM (eg, some form of linux). Currently malware threats are a decent bit lower for that platform, and all the major browsers (apart from IE and safari) run well in that environment. – Rory McCune Nov 14 '10 at 18:56
  • @Rory: I think HD Moore does run some Linux under Win7, but I'm fairly sure he browses with Win7 in Win7 because Windows does provide a lot of look-feel and standard stuff that Linux does not. – atdre Nov 14 '10 at 23:32
  • 1
    All good points. I'd only question running a windows host. Why not run a linux host with windows VMs? Also, set your VM to non-persistent mode for web browsing so you don't even need to revert to a snapshot. Run tripwire or aide and log off host. – Bradley Kreider Dec 14 '10 at 20:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.