How to make your Qubes OS more secure (Best Practices)

[fiftyfourthparallel]

@fsflover

One possibility is to make your sys-usb qube disposable. In this case, malicious USB devices can only compromise it until reboot. Same for sys-net and (maybe) sys-firewall.

To add to this, restarting sys-net (and hence the whole network VM stack) before you do anything sensitive would put the disposable nature of the stack to good use.