1

At work we have a discussion on computer security.

The scenario:

  • Our work PCs are Windows desktops that are part of a windows domain
  • Users have domain accounts they use to log in to windows
  • The user's domain accounts do NOT have local admin access
  • Our organization has a group of developers
  • The developers would very much like to have local admin access to their computers (our experience is that developing on Windows with Visual Studio without local admin is a hassle)
  • But the IT department does not want to give any users any sort of local admin access to the computers (not even create local users)
  • Instead, the developers are allowed to install virtualbox and install whatever they want in virtual machines.

The issue/question:

  • I argue that the security implications of having guest VMs running with local admin, is on roughly the same level as running the host OS with local admin.
  • My reasoning is that if for instance a guest OS was infected by a virus, the potential implications would be on par with the host OS being infected.
  • After all, the guest OS can access the same network resources (on the IP level) that the host OS can (possibly dependent on the VM software config), and therefore the surrounding network infrastructure is exposed to the virus no matter if the virus is running on the host OS or the guest OS.

Am I right? Am I wrong? Does any one have pointers to good articles/discussions on the subject?

1

From the security perspective , the current setup is better , i.e running virtual machines on host , instead of giving developers local admin rights , because it is not just about the virus problems that they are not given local admin access. There are other security implications to that. Installing virus is just one aspect of that.

  • Could you mention a few of those other security implications? – codeape Mar 2 '16 at 12:26
  • Its very obvious , local admin access means all the access , they are free to do what they want , there will be no accountability in that case, who did what. they may erase their own logs too. – Ijaz Ahmad Khan Mar 2 '16 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.