I work infosec so my question would what computer? Server? Lab workstation? Kiosk? Hardened windows 10/11 or Macos. My threat model will be for persistent thre

I work infosec so my question would what computer? Server? Lab workstation? Kiosk? Hardened windows 10/11 or Macos. My threat model will be for persistent threat actors so aside from hardening, I will collect a ton of edr and network data and couple it with purpleteaming+threathunting. Believe it or not windows can be locked down tight and macos can get pwned easily as well. I will of course ban email as first order business unless you have an exemption and you don't access a secure network. Basically what they do now by having a separate dedicated machine for accesing a secure network with usb ports soldered off. Admins will use MS recommended privileged access workstations for admin activity which is separate by policy from secure and insecure workstations. No layer 3 lan traffic. Each workstation gets a routed vlan , restricts traffic on the host and router acl to an internal vpn terminator that will also act as a firewall to implement MAC to resources. EAP-TLS where required. Secure network is not connected to any other network but not airgapped either. Airgapping is for data storage/processing dedicated nodes not user workstations. What they do now with smartcards sounds good for logins. JEA, Cred guard, wdac whitelisting, blah blah hardening like I said before but hardening is the start as is "all patches are emergency patches". Detection, Detection ,Detection (includes both types of hunts); shut up and give me all your logs. TLS decryption and packet capture device on every router interface (netwitness?). Of course Top secret//SC, codeword clearance and above will never touch a computer and Printers, came, iot,etc... will also be monitored very closely and hardened even with segregation. Of course you can't take a secure computer off premises and insecure computers get wiped if they stay off prem too long and are all subject for quarterly firmware and hardware integrity inspection just like secure computers. No builtin cams or mics on any computer period. I am sure I missed a lot but for workstations this comes to mind. Servers, cloud, mobile are a whole other beast.