Security for Teenage Children's x64bit Win 7 PCs - Suggestions?

[trjam]

VooDoo Shield along with HP or Malwarebytes Free is all you need. I can assure you it makes the most logical sense on how to deal with teenagers and protecting your hardware.

[Janus]

Just a a proposal if it may not cost much, but still have to provide good security .Use sandboxie to sandbox your browser and download folder. Get Paragon backup and recovery free. Create the Paragon recovery disk. Backup your system. Get a good Av scanner to go with windows firewall. And then common sense, probably the hardest part. (difficult for all,myself included )

[ComputerSaysNo]

Come on guys/gals. Put things in perspective. All you need is MSE + CHROME with ABP. It's that easy You may want to use EMET aswell but that's about all you need.

[wat0114]

Originally Posted by ComputerSaysNo

Please don't do this. Admin accounts + regular users = pwnage

I know. The question was asked, somewhat facetiously, because it seemed to me some suggested granting rights via UAC to install programs, which means the ability to run as admin.

[Feandur]

Chrome (with ABP) + Standard User

Then : -

Either:
EMET / Group Policy...don't know much about these...[need to study Kees1958 posts];

OR:
a vote for Voodoo Shield...thanks trjam....;
Great replies on Appguard....thanks Dark Shadow, pegr

Not to forget

Sandboxie.....[bit of study needed here also]



......just wish SD was still being developed...oh well.


Excellent suggestions all...

Any other experiences ?.
please fee free to add to what works /didn't work

- have a good day
feandur.

[m00nbl00d]

Originally Posted by Feandur

[...]

Either:
EMET / Group Policy...don't know much about these...[need to study Kees1958 posts];

OR:
a vote for Voodoo Shield...thanks trjam....;
Great replies on Appguard....thanks Dark Shadow, pegr

If you're going to use Google Chrome, then you could consider the possibility of using Google Chrome group policies, as well. This way, you can be sure they won't override any possible settings you may want to define yourself.

-https://support.google.com/a/bin/answer.py?hl=en&answer=187945

Also, I don't think you have to exclude either EMET/Group Policies if you choose to go with VoodooShield or AppGuard, IMHO.

Other than this, my approach would be similar to the one Hungry Man mentioned, but if there's no requirement for such, then I'd skip Adobe Reader X, and just use Google Chrome's built-in PDF reader.

You may also want to install BitDefender TrafficLight extension for Google Chrome. This way, you'd have Google's internal domain/file blacklisting, plus TrafficLight's.

I'd also make them scan downloaded file, as long as it won't violate their privacy, with Virus Total and HitmanPro. Also, keep MBAM.

Backups in place... and, not to forget, you could consider the possibility of switching DNS servers from your ISP to something like Norton DNS or COMODO DNS, which will prevent access to malicious domains.

But, of course, education above everything else! If they understand the risks, then they will be more prudent...

[Sully]

Personally, I think it boils down to only a few things to consider.

1. who owns the machine? Does the owner wish to maintain a clean system? Then use whatever means necessary to do this regardless of how the borrower feels. If they don't like it, they can save and get thier own machine. The old saying "beggars can't be choosy" is appropriate.

2. does the person you might be setting things up for want to learn or just click and install? There is a huge difference and the methods used are just as different.

3. are you limiting children? The age and maturity of the child(ren) in question come into play. Just because a kid isn't stupid and wants to learn does not mean you don't maintain some form of control still, especially in your own home. As adults who have already been through those early years (and beyond) you have gained wisdom that a child/teen still does not possess, even though they think they do. Wisdom also knows when you must transition from control to trust.

Now, how do you develop your security and/or restrictions? There are many to choose from. LUA is IMO the easiest option, and the most robust. Whether you allow UAC or not is dependent upon the circumstances. If you rely on HIPS, it will work, but you probably allow the user(s) to have access to that, so they can bypass it or answer a new prompt incorrectly. LUA is not foolproof, but is usually good enough.

Sul.

[SirDrexl]

Originally Posted by Dark Shadow

Setup Standard user Account with chrome or Dragon Browser chrome based.Add EMET and add all browsers in the configuration.AppGuard is great idea but remember a standard account must be set up to use parental control of AG to protect its defenses from being disabled.I also would suggest norton DNS and choose the best policy the fits.

Yeah, I was also going to suggest using Norton's DNS, on at least the porn filter server. I don't know how effective it would be, as it wouldn't block, say, porn torrents from a public tracker that are listed on a general torrent search engine (I checked that out ), but it may reduce "casual" browsing for porn. Then again, I guess their friends could just tell them the actual IP addresses if they're savvy enough...

Also, what specific version of Win7 is this? Bear in mind that if you want to configure something with Group Policy you'd need Pro or higher. Although, if you're interested in Windows 8, the inexpensive upgrade being offered is for Pro (regardless of which version of Win7 you're getting now).

[ComputerSaysNo]

Originally Posted by wat0114

I know. The question was asked, somewhat facetiously, because it seemed to me some suggested granting rights via UAC to install programs, which means the ability to run as admin.

Yeah I get you BUT for a teens PC limiting isn't going to work.

[Feandur]

m00nbl00d
Google Chrome group policies - way out of my depth.....but I've found a guide to EMET that I would like to try out. http://www.wilderssecurity.com/showthread.php?t=333016

Scanning a good idea....Using Traffic Light., and installed the Virus Total app "VTchromizer" for quick scans. https://chrome.google.com/webstore/d...eplglfidafgoka

Images done and backed up - already had to resurrect a non-booting Laptop for a certain teenager.



Sully

If you rely on HIPS, it will work, but you probably allow the user(s) to have access to that, so they can bypass it or answer a new prompt incorrectly

Yep...I've watched them both do it at one time or another

Still...havn't entirely given up on Voodoo shield, say, if we can agree the installed programs.


---Though I must admit I'm beginning to wonder if they should just use Sandboxie for general surfing,...probably takes care of most of the issues....then its a fall back to the system image.


Guess I have to roll up my sleeves and sit down and read up on configuring Sandboxie.


- thanks Wilders folk.
Good discussion.


- have a good day
feandur.