TL;DR Security done this way is expensive, using four physical devices: A gaming desktop, a secure workstation, a NAS, an ESXi server. The hardest part at first was the discipline to use each workstation for its intended purpose and breaking bad habits, IE not browsing the web from the gaming machine etc.

As a pentester, here are some of the things that I use and do to reduce my personal attack surface. I separate out functions by device. Note that, other than the windows 10 section, this isn't cheap and isn't for most people. I've invested a large number of hours into this setup to get it to a place where I feel its "trustworthy enough."

If I were a regular user and had to use Windows 10, most of the following guide would be helpful (https://hackernoon.com/the-2017-pentester-guide-to-windows-1...). I went with a hybrid approach and incorporated elements from Sean Metcalfe's (Trimarc Security) guide on developing a secure baseline (https://adsecurity.org/?p=3299). I've done most of this to my gaming computer. I only play games and use VOIP programs on this machine. Other programs I use on this system (not in the guides) are: glasswire, herdprotect, immunet. I set up win10 to take a full system backup once a week, and this gets auto backed up to a NAS.

I use QubesOS for all non-gaming functions. This can be a painful OS to learn, but I like its "containerization" of information and the workflows for using it. Encrypted, password protected copies of my various VMs are backed up to the NAS.

I log some specific event types from every device on my network, and send it to a SIEM in a VM on a ESXi system. I have custom splunk dashboards to sort through this data and only show me what I think is important.