Security implications of "local admin on host OS" vs "local admin on virtual guest OS"

Question

At work we have a discussion on computer security.

The scenario:

• Our work PCs are Windows desktops that are part of a windows domain
• Users have domain accounts they use to log in to windows
• The user's domain accounts do NOT have local admin access
• Our organization has a group of developers
• The developers would very much like to have local admin access to their computers (our experience is that developing on Windows with Visual Studio without local admin is a hassle)
• But the IT department does not want to give any users any sort of local admin access to the computers (not even create local users)
• Instead, the developers are allowed to install virtualbox and install whatever they want in virtual machines.

The issue/question:

• I argue that the security implications of having guest VMs running with local admin, is on roughly the same level as running the host OS with local admin.
• My reasoning is that if for instance a guest OS was infected by a virus, the potential implications would be on par with the host OS being infected.
• After all, the guest OS can access the same network resources (on the IP level) that the host OS can (possibly dependent on the VM software config), and therefore the surrounding network infrastructure is exposed to the virus no matter if the virus is running on the host OS or the guest OS.

Am I right? Am I wrong? Does any one have pointers to good articles/discussions on the subject?

Answer 1

From the security perspective , the current setup is better , i.e running virtual machines on host , instead of giving developers local admin rights , because it is not just about the virus problems that they are not given local admin access. There are other security implications to that. Installing virus is just one aspect of that.