Table of Contents

1. Introduction
2. Get Educated
3. Behavior
4. Browsers
   1. Firefox
   2. Tor Browser
   3. Chrome
   4. Safari
   5. Plugins
   6. Internet Explorer
   7. Java
   8. Flash
5. 3rd Party Software
6. Malware
7. Antivirus
8. Firewalls

Introduction

Securing your computer for web/internet access is not an easy process but it can be done to some extent using various applications and browser plugins. Although Windows is not in my mind, I will touch on this operating system to some extent.

For the most part getting "hacked" is about your behavior. If you seek danger it will find you; your behavior is also related to your innocence, at least to some extent. If you click on links you do not know, it is likely you will end up in undesirable places. What is recommended when you browse the web is to think of your experience as  you would on your normal day to day activity. If you must view certain sites for whatever reason; we'll call it "in the name of science," make sure you do it with a very secured browser.

By the way, this document will be updated often. At the same time, leave me a message and I will investigate and post more details about your concern.

A word on Windows. -> Even though I've used Windows for over 20 years, I do not like this operating system; I do not use on any personal machines. Windows has nice features and it's very cheap to purchase with a new PC, but it is just too hard to secure. Personally I opt for a Mac or a Linux distribution (debian or redhad/centos). If you must use Windows, I suggest you get educated with Virtual Machines such as VMWare or VirtualBox - simply install your "risky behavior" Windows on a VM and play around - just make sure you learn about security tools such as Firewalls and NAT vs Bridged Mode (NAT or Bridged). If VM is too much for you to deal with, just make sure you stay up to date with patches - do not use Windows XP anymore - read this -> https://www.microsoft.com/en-us/WindowsForBusiness/end-of-xp-support.

Get educated

• @ Reddit
  • https://gist.github.com/atcuno/3425484ac5cce5298932 -> fork -> https://gist.github.com/springzen/1a62c90f1caca6843ed35971c7281b52 
• Know your CVEs - Common Vulnerabilities and Exposures (CVE®) is a dictionary of common names (i.e., CVE Identifiers) for publicly known cybersecurity vulnerabilities. CVE's common identifiers make it easier to share data across separate network security databases and tools, and provide a baseline for evaluating the coverage of an organization’s security tools (source). 
  • http://imwsoftware.com/
  • https://findthreats.com 
  • https://nvd.nist.gov/ 
  • https://www.us-cert.gov/ 

Behavior

• Do not give your credit card to unusual requests such as "security updates" requests via SMS/texting.
• Avoid giving your Social Security Number/Social Insurance Number/National Insurance Number over the web. If you must, try to call it in or make sure the site you are dealing with is legitimate (click on the lock in the address bar in your browser and identify the company certificate issuer - I will write something on certificates).
• If you must open email attachments (mostly of suspicious origin) be paranoid and follow this guide: https://security.stackexchange.com/questions/32928/how-do-i-safely-inspect-a-suspicious-email-attachment

Browsers

Firefox

By far the most extensible browser out there Firefox should remain the #1 choice for those wanting to browse the web securely. However as with all browsers, plugins remain the most important addition to your browser security settings. A huge plus for Firefox is the Tor Browser 

Tor Browser

If you care for privacy perhaps you should download it. Tor browser can be slow due to its approach to attempting to keep you private. However just installing and using the Tor Browser does not ensure an ad free experience. You should install an ad blocker of some kind.

Chrome

Chrome is perhaps the most concerned with Privacy but its integration with Google makes this a bit questionable by some. Overall Chrome is very good if you care to have a common look and feel on many computers using your Google account. However, when searching via Google when logged in, your searches will end up in various locations; namely targeted ads and news articles.

Safari

Safari is a relatively good browser if you use a Mac. It is perhaps more secure than any browser produced by Microsoft but Apple's reluctance to answer various zero day exploits in a timely fashion makes this browser a bit undesirable. As always make sure you have privacy plugins turned on.

Plugins common to Firefox, Chrome and Safari

Here are the most essential privacy/security plugins:

uBlock Origin or uBlock (if you must use Safari)

• uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
  • Download for Chrome
  •  Download for Firefox
  • No dice for Safari, Download uBlock instead
  • For those concerned with Disconnect here are some related articles:
    • https://github.com/gorhill/uBlock/wiki/uBlock-and-others:-Blocking-ads,-trackers,-malwares
  • If you care to have more control over uBlock you can use uMatrix
    • Chrome
    • Firefox
• Flashblock - simply blocks Flash by default - but it gives you the ability to unblock Flash on individual sites. The recommended thing is to get rid of Flash (forever) - but if you must, use one of those plugins.
  • Download for Firefox
  • Download for Chrome
  • Do not enable Flash on Safari
  • Do not enable Flash on Internet Explorer or Edge
• WOT/Web of Trust - know which website to trust
  • Download for Chrome
  • Download for Firefox
  • Find the other supported browsers here
• HTTPS Everywhere - force sites to go HTTPS (HTTP over SSL)
  • Download for Chrome
  • Download for Firefox
  • Sorry for the rest of the browsers.
• (Not free [mostly]) Password Managers - use these to secure your passwords
  
  • LastPass
    • Download for Chrome
    • Download for Firefox
    • Download for all browsers
  • 1Password
    • Purchase here
  • Educate yourself on more password managers @ Reddit

Avoid Internet Explorer or any browser created by MS

• This one is easy. Do not use any browser created by Microsoft. Just perform a few web searches via Google and look for "why internet explorer sucks" or simply use your own criteria to prove that point. If you must, try using Edge instead: https://www.microsoft.com/en-us/windows/microsoft-edge 
• If you do insist on using Edge, make sure you set your security settings to the highest. Use this guide http://www.windowscentral.com/all-you-need-know-privacy-windows-10 or search for other sources for Microsoft Edge security settings.

Java

• Recommended: do not install/enable Java in your browser.
• If you have to install /enable Java in your browser, make sure you update Java often

Flash

• Do not install it. Ever.

Installing 3rd Party software.

Whenever you install third party software try using the following services.

• Windows
  • https://ninite.com/
  • https://unchecky.com/
• Mac
  • http://www.getmacapps.com/
  • Homebrew -> How to geek guide to Homebrew
• Linux
  • apt-get -> guide
  • yum -> guide -> tips

 

Malware

Definition: "Malware, short for malicious software, is any software used to disrupt computer operations, gather sensitive information, gain access to private computer systems, or display unwanted advertising" (source)

If you suspect Malware on your machine you should use a malware removal tool

• Malwarebytes for PC and Mac will remove most Malware from your machine: download it and give the free edition a try.
• If you are running Windows 10 go to: https://www.microsoft.com/en-us/safety/pc-security/malware-removal.aspx and follow the instructions given by Microsoft.

Follow the reddit guide to removing/dealing with Malware

• https://www.reddit.com/r/techsupport/comments/33evdi/suggested_reading_official_malware_removal_guide/ 

Antivirus

Windows

• Windows Defender download - once installed make sure  you run a scan right away and ensure you have a scheduled scan for at least once a week
• Windows Firewall

Firewalls

• Windows Firewall
  • http://windows.microsoft.com/en-us/windows-8/windows-firewall-from-start-to-finish 
• Mac firewall
  • Official guide: https://support.apple.com/en-us/HT201642
  • Macworld guide: http://www.macworld.com/article/2940180/fire-up-your-macs-firewall.html 
  • (Recommended) - use Little Snitch
• IP Tables/Firewall
  • Ubuntu: https://help.ubuntu.com/12.04/serverguide/firewall.html
  • CentOS: https://wiki.centos.org/HowTos/Network/IPTables
  • Linux: 
    • http://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/ 
    • https://www.linux.com/learn/introduction-uncomplicated-firewall-ufw 

If you want to keep up to date on the latest Common Vulnerabilities and Exposures (CVE) visit us at http://imwsoftware.com/