Do I need to do anything for security. I am only average level with Windows 21H2 22000.556

Hello
This is a quote from Windows security. I have TPM 2 and secure boot enabled but do not know what else to do - it seems to refer to the suggestion I should enhance security:
"Your device exceeds the requirements for enhanced hardware security (Note: In Windows 20H2 this message will say "Your device has all Secured-core PC features enabled")
This means that in addition to meeting all the requirements of enhanced hardware security, your device also has System Management Mode (SMM) protection turned on.

Standard hardware security not supported
This means that your device does not meet at least one of the requirements of standard hardware security.

Improving hardware security
If the security capability of your device isn't what you'd like it to be, you might need to turn on certain hardware features (such as secure boot, if supported) or change the settings in your system's BIOS. Contact your hardware manufacturer to see what features are supported by your hardware and how to activate them.

Specifically what should I turn on in the BIOS?
TY

@Maranna


The DEL key at boot will get you into the BIOS. Once there the F7 key will get you the Advanced mode.
I just checked your motherboard manual... on the Boot tab is the Secure Boot settings... but the manual doesn't show what they are.


The ? key might get you a list of the Fkey functions. F12 may be the screen shot key.


You could probably also just use a smart phone to take pics of the settings at... Boot > Secure Boot
Then we could probably help with some advice.


Personally, I wouldn't worry about it. It sounds like Windows Security, over-reacting.




For example, this is what's under my Secure Boot settings in the BIOS. (ASUS X570 motherboard)...
And as I said... I just ignored it... (left it all at defaults)







This is why you should probably take pic(s) of what's under your Secure Boot settings,
if you decide to mess with it, and want advice.


If you just run Windows defender, with maybe Malwarebytes as a 2nd opinion,
you don't really need to worry about all this.

The secure boot just gives you a choice of Windows=secure boot or other= no secure boot (?Linux).

Personally, I wouldn't worry about it. It sounds like Windows Security, over-reacting.
That’s the kind of reply I like to hear.
It isn’t scary.
TY

I cleared all keys a long time ago thinking it was the way to set secure boot. I have since learned otherwise. I have been keeping controlled folder access off thinking that might be what Windows was referring to but not so. Controlled Folder Access only builds up a bunch of recent issues which cannot be removed so I have it off -would you suggest on or off?

Maranna said:

Personally, I wouldn't worry about it. It sounds like Windows Security, over-reacting.
That’s the kind of reply I like to hear.
It isn’t scary.
TY

Click to expand...

Unless you're Bank of America or something, and just haven't told us... I seriously doubt any TPM or Secure Boot settings will be needed. You'd be so low on the hacker's lists, that they probably won't even notice you. :)


In the past 20 years, I've surfed many of the nastier places on the interwebs.
Only twice did I get hit with anything (ransomware on Windows 7)... and restoring from a backup removed it.

Microsoft's biggest customer base is corporations. That's who they design and code for.
It's like having a car that will only start with a hand print and voice activation...
just so you can run down to 7-11 every now and then.


Just keep good backups, and you'll probably be safe no matter how hard you try to get infected. :)

I have Asus Tuf Z 390 - Plus Gaming Wi-Fi
16 GB Ram which likely accounts for the difference in our BIOS.
Do you have an opinion about controlled folder access being on or off?
PS I have duplicate Macrium images on separate hard dries so I am trying to be safe. At 82 I have lost interest in nasty sites-to each his own!
Thank you for your help.

Maranna said:

Do you have an opinion about controlled folder access being on or off?

Click to expand...

Honestly... I've never seen or heard of that.





I'm probably not the best person for Windows Security type questions.
On Win 10 and Win 11, I took Windows Security out back and beat it senseless.
Now Windows Security and I get along famously.


Every now and then, late at night, I hear it whimpering.
But I don't listen.

Maranna said:

Do you have an opinion about controlled folder access being on or off?

Click to expand...

I have controlled folder access (CFA) switched on, and I allow trusted apps through CFA.

So, after switching on CFA > a (generally non-MS) app can't save anything on your computer > go to 'allow additional apps through CFA' > you see a list of 'recently blocked apps' > google the app if you are not sure > allow that app through CFA > that's it

It increases your security, good luck!

I agree with @Ghot. End users are small fish in a big pond and are only as vulnerable as they let themselves be. Some of the security statements seem so dire and are unclear exactly what they mean, thereby putting fear in the users. I have a LOT of data, but do not have my drives encrypted (bitlocker on) as there is nothing stored that is of interest to anyone but me and I have nothing to hide. IMO it's just another pin/password to have to remember and more hassle than it's worth. I have a good backup plan in place and am not the least bit worried about losing my data.

It's my opinion that some users take their security measures too far and become paranoid about it. The best security measure one can have is their own brain. Being proactive is better than being reactive.
Antivirus/antimalware protection is important and they do their job, but YOU are your best security when it comes to hackers.

Know NOT to fall for phone call scams from callers identifying as Microsoft. McAfee, Amazon, Google or any other big company no matter how convincing they sound because these companies will NEVER call you.

Never call any number that might popup on your screen and NEVER, EVER give anyone remote access to your machine, no matter what they say (the only exceptions are if you know without doubt the person or company you are working with is legitimate.)

Know NOT to click on ads on websites (especially social media)

Know not to open links in emails if there is any doubt they are legitimate (even if they appear to come from close friends).

DO NOT keep a file on your computer that has all your passwords in it.

NEVER automatically store login info in your browser, especially for financial sites you use. Regularly change your passwords for such sites.
Consider using a password manager instead.

If you search the web for a site, do not click willy-nilly on the first link in the search results. Pay attention to the https address to know you are going to the official company address and the site is secured.

If by chance you are ever hacked, DO NOT EVER SEND THE HACKERS ONE RED CENT. Shut your computer down and contact a knowledgable professional if you are in doubt, or preferably restore a current backup to get yourself going again.

Just use good, common sense. And for goodness sake, regularly backup anything that is important to you and don't leave your backup drive attached to your computer. Full system backups are preferable.

I can't thank you all enough for all of your help. I respect all of the information. This is a great forum.

Glasskuter posted excellent advice ....all of it! As far as security, you have to assess what you want to be protected from, hackers, physical access or theft, corruption or data loss due to hardware failure, etc., and make decisions based on your needs. Do you need cloud storage in case your computer is stolen or your house burns down?

You also have to decide what measures you use are to be trusted. There are variations of major browsers that claim to be more secure, but the big three, Firefox, Chrome, and Edge would not be as big as they are if they weren't trustworthy. Which would you trust more, a modified secure browser or one from the main company? Lots of people will go either way, it's a matter of what you trust in.

Like I said, Glasskuter posted excellent advice, but I would add that you should protect your email password just like your financial passwords because they can be reset with an email link. Most sites we use are not high security like the forums, but I would never share or document your email or financial user names and passwords and use a password that is long and would be hard to crack.

Also, much of my software is freeware, but I have been using these programs for years. Wherever you get your software, do some research to see if there are complaints.

Windows and many software programs access the internet for various reasons. Of course your web browser or email programs needs to, but a photo viewer? It maybe be just checking for updates or collecting other data. Many firewall programs will notify you and ask permission before allowing access to the internet, and you can check to allow once or remember that answer.

Computer are no longer a novelity. We have a lot to protect!

Maranna said:

Do you have an opinion about controlled folder access being on or off?

Click to expand...

Mine is off. I have a lot of software that writes to my computer but I trust it all. CFA leans towards the right on the paranoia scale IMO.

I agree that leaving it off is wise b/c as it was pointed out Windows can be a bit paranoid and I think it is in this case. Back up, backup, backup.

Ghot said:

Unless you're Bank of America or something, and just haven't told us... I seriously doubt any TPM or Secure Boot settings will be needed. You'd be so low on the hacker's lists, that they probably won't even notice you. :)


In the past 20 years, I've surfed many of the nastier places on the interwebs.
Only twice did I get hit with anything (ransomware on Windows 7)... and restoring from a backup removed it.

Microsoft's biggest customer base is corporations. That's who they design and code for.
It's like having a car that will only start with a hand print and voice activation...
just so you can run down to 7-11 every now and then.


Just keep good backups, and you'll probably be safe no matter how hard you try to get infected. :)

View attachment 25039

Macrium Reflect, AOMEI Backupper and Hasleo Backup Suite - GUIDES

How to use backup software... 1. When everything is working perfectly... make a full Windows backup. 2. Then, if something breaks... restore from the latest backup. 3. Then... try "whatever you were doing" a different way. If it still breaks Windows, then... go to step #2. 4. Repeat...

www.elevenforum.com

Spoiler

Now... if you decide to BUY Bank of America, or start your own branch of the CIA or something,
then you should probably look into some industrial strength security that comes with... bodyguards.

Click to expand...

You should add that image to you're Signature

Devlin1888 said:

You should add that image to you're Signature

Click to expand...

Naw... I like posting it when needed.

Maranna said:

The secure boot just gives you a choice of Windows=secure boot or other= no secure boot (?Linux).

Click to expand...

Some Linux systems will boot but they have to be whitelisted by MS.

As I said this is a great form and I have learned a lot here.I have always imaged with Macrium to two different external drives and keep one unplugged in case I am ever hit the external drive will not be hit. Thanks for all the advice.

Being a Malware Removal Specialist i think you have been given some good advice ! The main thing is to be careful of what sites you visit ! Do not get frightened to the point that you download a bunch of Virus protection ! It's ok to have more than two but do not have them running at the same time ! Got & Glasskuter gave you some good advice ! Be Safe out there ...................
Chuck

At 82 I go to sites you would be proud to show your mother. For security I use Windows Security with MBAM free which I run regularly as it has no real time protection as Windows security does.