The environment
Our company has a reasonable (from the point of view of a regular employee) security policy consisting of, among other things:
- Sophos suite covering both local antivirus solution and Internet access screening (corporate proxy with a MITM proxy for https),
- Windows 10 with disk encryption,
- automatic log out (lock) timer per domain policy,
- central control of installed software (both installations and compliance checks of user-installed sowftware),
- no single-sign-on, very few if any mandatory programs continuously running,
- users can be local admins (devs and such) but can't override domain policies (like the automatic lock after preset time),
- VPN access for field workers.
In place are legal measures as well, like non-disclosure agreements signed by every employee.
Users have full physical access to their machines (from plugging USBs to opening the box and fiddling with stuff, though usually nobody does the latter).
The question
Given the situation described above, is it reasonable to assume that giving an employee a Virtual Appliance for a common virtualization environment (VMWare, VirtualBox, KVM...) is no different than giving them a laptop with same configuration to work remotely? The VM would be run either on a throw-away computer or the employee's private computer*. Am I missing something important here which would disqualify the VM run on arbitrary hardware?
One thing I can think of is poorly secured VM host on which a malware program (for example a keylogger) can sit between the user input and the VM, which would not be the case for a better secured physical computer (but admittedly would work with a remote desktop from said poorly secured computer). I'm interested in possible problems like this one.
