Always a fun one, but it all boils down to my favourite question: "What is your Threat Model?". Understanding your threat model is crucial. Are you protecting against casual thieves, determined hackers, or state-level actors? Each scenario requires different levels of protection. If your threat model includes interdiction by (possibly) a state actor, I would really hate to be in your shoes. If your threat model is to be reasonably safe with reasonable usability, then you got something to work with.
Also very logical that you do not want to bother with Linux, even though it can have some advantages if configured correctly. It can also easily be your downfall as it requires some technical knowledge to keep it secure.
As an enthusiast and professional I also have a Windows environment. The good news is that a standalone Windows environment is much easier to keep secure than a domain joined device, since your attack surface can be reduced to the bare minimum.
What I would do:
First things first, debloat windows 11. Microsoft has lost their mind with the amount of bullsh*t preinstalled. [1] For this you can use
GitHub - Raphire/Win11Debloat: A simple, easy to use PowerShell script to remove pre-installed apps from Windows, disable telemetry, remove Bing from Windows search as well as perform various other changes to declutter and improve your Windows experience. This script works for both Windows 10 and Windows 11.. There are a lot of other scripts, but this one did not break any useful system functionality for me.
I can recommend Defender EDR. If you already have an O365 license, then it might be included, otherwise the P2 license is also very affordable. It goes beyond a normal antivirus and will be more in line with your threat model. Might take a bit to understand the portal and all, but it will be a much safer experience than just installing a cheap (and "dumb") agent of another vendor. Crowdstrike Falcon is also nice, especially after their latest fiasco you might be able to get it for cheap too. ;-)
Also Defender EDR (MDE) keeps track of your vulnerabilities as well. Which will give you a nice overview and help you to prioritise updates. Personally, I only use biometrics when I am at home. This for ease of logging in, when I leave the house with my laptop, I make sure to disable biometric authentication. In addition to biometrics, consider using multi-factor authentication for critical accounts. This adds an extra layer of security beyond just your laptop's defenses.
Bitlocker is indeed included from the Pro edition, which will be more than sufficient. Talking from experience, if somebody steals your laptop and it is encrypted with Bitlocker and the BIOS is also configured properly. There is no worry, unless they use the aforementioned wrench method.
Also when you get your device, start thinking about hardening. If you combine it with MDE P1/P2, you will also get recommendations on how to apply hardening (ASR) rules. Otherwise I can advise you to take a look at:
GitHub - HotCakeX/Harden-Windows-Security: Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows | Provides tools and Guides for Personal, Enterprise, Government and Military security levels | Read The Rationale https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md. Basically hardening helps you to reduce the potential ways an attacker could exploit your system or software on the system. For instance, one of the most common ones is blocking untrusted macros in Office documents. It will definitely have an impact on usability, but it will greatly improve your security posture as well.
I would apply these to the host OS, and use VMware Workstation Pro to virtualise another instance of Windows where you can run untrusted stuff. Windows sandbox is also fine, but VMware workstation is now free for personal use anyways.
Implement a regular backup strategy. Even with all these security measures, having a recent backup can save you from data loss due to theft, hardware failure, or ransomware.
Consider enabling proper auditing. Yeah, it's a double-edged sword, because it is like leaving breadcrumbs of your digital activities. Great for forensics if something goes sideways, but not so great if your laptop falls into the wrong hands. It's a trade-off between having a detailed record and potentially exposing more info if your device is compromised.
Again, if you are ever at the level that a nation state has decided that you are on their target list. You will get hit with much more than just a phishing mail, if you are at that point in life I can only recommend to hire someone with an intelligence background who is willing to prepare you for that battle. 99,99% of people will not have to deal with that stuff fortunately, and I have assumed you do not have enemies in Virginia or Moscow.
There are arguments to be made for the compromise on
privacy, and they are valid, but considering the circumstances I think this would be sufficient. If you want to combine a high level of security with a high level of privacy, you will have to roll up your sleeves and start fighting the battle against Big Tech.
[1]
www.avast.com
