Is it possible to protect my bare-metal from compromise, so that I can be fairly confident that (for example) restoring a VHDX system image every month keeps me clean? If so, how?
I'm building a rather costly new PC. I would like to isolate my development and game environments from firmware as much as possible, especially for security reasons (e.g. bootkits and firmware rootkits). I worry more each day about trusting my required software.
- Environments: Game (Steam, Oculus) vs. Development (Visual Studio)
- Windows 10 Professional, multiple licenses
- Purchased newly packaged OS installation media to ensure it is clean
- Running development from a VHDX via Hyper-V
- Game environment benefits from direct GPU, so less useful via Hyper-V
- I have Secure Boot enabled
- System supports TPM, willing to install and enable
- Not using BitLocker, but willing to
I care less about single-instance vulnerabilities (e.g. compromising one bank account password, or leaching some GPU today) than I do about a long-term issues (e.g. a bootkit that, for the next four years of this PC's life, renders all password changes ineffective, or continually mines cryptocurrency).
The isolation desire is also for mundane performance reasons (e.g. separate SQL Server from Steam downloader), but hawk-like attention to running processes or simply dual-booting addresses that.
A related question, Is dual-booting more secure than having a single operating system installed? , raises but does not solve the long-term threat concern. Additionally, I feel the accepted answer underestimates the value to attackers of compromising a large quantity of unremarkable PCs, and thus underestimates the likelihood of it happening.