Endpoint Protection

I was wondering if there was any step by step guides to help when installing windows xp from scratch to keep me protected.  Here is what I plan to do:

I already started Derik's Boot and Nuke to write 0's to the hard drive.

I am trying to lock down my pc as much as possible. I got 2 trojans within the past month. Possibly from webkinz or facebook, but cannot prove either. So, I want to lock down my pc as much as possible. Here is my plan. Do I need to do anything else?

My wireless router is already set up to use encryption. I also have MAC filtering on so that only my pc and my playstation 3 can get onto it wirelessly. I do not have rules set up on the firewall on it. I only see where I can set ip rules and I dont know how to set up an ip rule without blocking all of the internet. I may be able to add ips as I go?

I am going to set up a policy in Windows XP. Probably more than one actually. I want to create strong password policies. I will create users for each user that will be using the pc. I would like to make them all limited users, but that always seems to be a pain because then the kids cannot do what they need to sometimes. I also want policies to prevent application from being installed or at least prevent them without a password. Not sure how to do that yet?

Next, Norton will have its updates of course. I did not see a lot of options for firewall with it. I would like to install Zone Alarm as long as Norton does not complain. Unless I can find good options in Norton.

I am going to set up proxies in Firefox and IE8. I will put 0.0.0.0 as the proxy. Then, I will add exceptions to the sites I want to use. This way, it locks down all the internet except only what I say.

I will install better privacy add on, and no script add on in Firefox. I cannot remember all the settings in Firefox, but I will turn them on.
I will show everyone to use PrivateBrowsing also in Firefox.

In IE, I will turn on content advisor. Also, use inPrivate browsing. Thirdly, do the same proxy with 0.0.0.0 if possibile. Fourthly, set security on High and Privacy on High. However, sometimes activex seems to complain, so I have to allow some of them. Not sure which ones yet, but I think I know a few of the activex settings in IE.

after everything is installed, I am going to right click on each registry folder in regedit and deny all. I can always change this when I need to install something. Other than that, nothing should be messing with my registry. Of course, export the registry first.

I found something that will check for key loggers. I hear too much about people stealing identity from logging keystrokes. I want to prevent this or at least be monitored of it when it occurs.

Anything else I can do to lock down my pc?

Thanks in advance.

Hi,

This all sounds pretty good twhitehouse. A few items:

-Locking the registry could cause odd things to happen, be cautious.

-Running two firewalls, Norton and Zone Alarm, could cause system problems, I doubt Norton would support this setup. If you do it I would test it thoroughly.

-Ensure all products installed on the machine are up to date, particularly Adobe products and Windows. These are very common vectors of attack. I believe Adobe now has an update manager that schedules updates, in any case keep up to date on this.

Not to chime in and sound harsh or anything... 

But you are on a Symantec Endpoint forum, asking for insight on how to lock down your Home PC?

I think your question, although very well detailed would be best suited for a different forum?

Now, not to sound like a total @$$, you could save yourelf alot of trouble and look into:

- Window Steady State

- Deep Freeze

- Or simply building a Virtual Machine inside your Windows Box and keeping a clean state of that.

Check out Sandboxie:

https://www-secure.symantec.com/connect/downloads/sandboxie

It sounds like these were more web based threats. Sandboxie will run your browsers in a sandbox so anything that is downloaded will go to the sandbox first and you have the option of letting it out or not.

Also, if you got these from Facebook or webkinz (never heard of it) there may have been some form of social engineering involved. Nothing will stop that.

THanks for the info.

Thanks for the info!

You're right, my bad.  I have Norton products, so I thought I would just try to pick some expert's brains.  I did not mean to offend anyone.  Sorry.