Firewall Security vs Anti-Virus

Question

Overview of my question

I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily available, I feel as though they are not the best method for me to engage in. I want to explore my other methods.

Current Idea(s) for Alternative Methods

I am not too concerned about being "attacked" as my computer's are mainly gaming and internet (Social Media etc.) however on the rare occasions where I need to do some work, it is often involving sensitive information. This may vary from legal documentations, source code, financial information, databases etc. I want to know your opinion on how I handle this:

1. The first port of protocol is a firewall. I am currently looking into reliable firewall's for home use. I know there are many dependent firewalls such as Comodo, ESET and Kaspersky, but I am looking for just firewalls. I am thinking of reviewing one of these Firewall Packages. Now I know what you're thinking - why not just use an Anti-Virus plus Firewall? I am not too concerned with people getting in, I am more concerned with them extracting data - so I believe the AV is the last option to prevent this.

2. After the firewall, I usually password protect the documents with a generic password (E.g. Pa$$w0rd), and then in a .7z encryption. Being paranoid, I also lock them in a virtual drive. For this, I have been using Symantec PGP Disk Encryption. I have been looking around for other data encryption packages, but have not found any decent competitors.

3. Network Monitoring is the next step/tactic I employ. Whilst this is highly ineffective, it's something that helps me sleep better at night. At present I use Network Magic. It lets me identify who is connected to the current Router/Internet Feed, lets me change the security method and the password in the event it has been compromised.

4. I guess the next thing I do, and possibly it makes absolutely no difference, is I continually change my IP address to prevent tracking. Like previously stated I am more concerned with people extracting the data from my computer so at any means, I will make it more difficult. (or at least attempt it!). Using the TOR network is painful, but if needed I will do.

What I need from you!

Basically (if you are not aware) I just want a secure way to prevent data theft (both cyber and physically). I do not necessarily want an AV, but I do need to employ some sort of security to help prevent access. I highly, highly doubt I'd ever be a target, but it is better to be safe then sorry.

I just want to know, if the above methods are worth employing, if they are effective, and how to maximise their functions. If you require more information please let me know.

Answer 1

Given your requirements, i'd consider doing all of my web browsing in a VM. You could keep it up to date, and then after your session simply restore a snapshot. Update Windows or what have you only, then create new snapshots as patches become available. I do this myself to avoid malware accessing my sensitive data.

Answer 2

Today (windows) computers are usually are fairly good locked against direct attacks from the network by default, at least if you specify that you are on a public network. That means they have a firewall, don't expose unneeded services to the outside etc.

I am not too concerned about being "attacked" as my computer's are mainly gaming and internet (Social Media etc.)

Unfortunately that is exactly the activity which makes you vulnerable. Lots of current attacks just require you to surf to some web site and then you get infected by drive-by-downloads, which typically exploit vulnerabilities in Java, Flash, Acrobat Reader, but also in Microsoft Office or the browser itself. You don't even need to surf to shady or illegal sites, because most of this malware is spread by hacked normal sites or through advertising (malvertising).

What helps here are modern browsers with multiple protection layers (sandbox etc), which are up-to-date all the time. Of course the rest of the system should be up-to-date too and you should not install any software which you don't really need - because they might associate itself with some file types and then get automatically executed if you access specific content from the web. What also helps is to block advertisements etc to reduce your attack surface (and lots of malware comes with the help of ad networks). And finally a virus scanner will help too.

And once the attacker got access to your system through malware all your local password protection might not be much worth, because the attacker can watch you, install key loggers etc and thus get access to these information.

If you have really sensitive data you might better use a separate throw-away system like a linux live-system or a virtual machine to surf the web, which should have only limited access to the outside (that is you get get data from this potentially compromised system put it can not push data to the main system).

Apart from that lots of web sites are vulnerable against web based attacks like cross-site-scripting or CSRF. These vulnerabilities can be used by other sites open within the same browser (not necessary at the same time) which can cause exposure of login information or other ways of identity theft or identity misuse. So you should not share the same browser profile for normal and for critical sites (like online banking).

If you follow all these tips you are not fully secure, but this helps more than installing some form of firewall, at least for how you use your computer.