What is the best way to make a netbook for a bank client?

Question

Information Security

Friends. I'm not a security specialist, so I'm asking for advice.
I will describe the situation as a whole. There is a local network: Yota is plugged into the "server" of Windows 10 Pro, and it distributes the Internet to other computers, a SIP hub, a wi-fi point. Everywhere there are only standard Windows security settings, no firewalls, no antiviruses. In case of a hit by viruses, ransomware, and other wickedness, we use Dropbox with the ability to rollback. We do not have confidential data, except for the client bank, the leakage of which would be something terrible. "Own" mail on the host, so you can return access to it, if anything, (at least offline).
I want to buy the simplest netbook and install a client bank on it (works through a browser), and do nothing else on it. (Except to upload XML-statements through a flash drive). The connection is supposed to be to our wi-fi, or you can briefly poke a Yota whistle into the netbook. Please tell me how I can set up a new netbook from the store so that everything is safe. USB token is used.
What should I take care of when setting up a netbook (only please do not frighten me with unnecessary garbage). Or leave all default settings, leave Edge and don't worry. Whether to install updates, and how?
Thanks in advance.

Answer 1

if the client is not tied to the OS -Linux will solve all problems

Answer 2

What should I take care of when setting up a netbook (just please don't frighten me with unnecessary garbage)

In other words, without too much detail, your question can be reformulated as follows: "I will not do anything, but I want it to be safe. How to ensure this?"
Well, what a question - such an answer. Use a netbook from the store and don't be afraid of any unnecessary garbage.

Answer 3

Is it possible to upload XML statements through a flash drive

viruses can still penetrate media
Use the same method with dropbox, only without installing the dropbox client on a netbook Install
Linux on an encrypted partition
Spin SELinux there Place
all third-party nastiness in containers and monitor packages and hosts for a couple of months