26

I run a small business out of my home and I'm not really doing anything labor intensive, no games and I'm not cutting any code or anything of that nature. A lot of what I do is phone based sales, so I'm basically just accessing my web based work gmail account, sending PDF contracts out to be e-signed and storing those on cloud based drive and a lot of browsing for info, finding leads etc.

I could probably get away with a thin client but I just bought a cheap laptop, and I am curious to know if I'm on the right track here by thinking that Virtualbox for everyday business is my best option for security and usability for just one desktop running Windows 10 (and if so maybe I should go with a lighter weight OS).

  • 73
    what do you want to secure yourself from? – schroeder Jun 21 '17 at 6:23
  • 7
    Why don't you just use Windows 10 directly, the way it's meant to be used? – Dmitry Grigoryev Jun 21 '17 at 8:49
  • 16
    You might want to have a look at Qubes OS. This project has good documentation on how to separate your tasks into different VMs. – A. Hersean Jun 21 '17 at 9:57
  • Also, in a VM you can take snapshots that allow you to restore to a previous state and they can't be accessed from the client OS. – programmer5000 Jun 21 '17 at 14:01
  • 2
    Do you use any programs that require Windows? – CodesInChaos Jun 22 '17 at 8:21
65

By using the same VM for browsing, word documents, and email, you are exposing all of your data to the same level of risk.

Instead of doing all of this activity in the VM, consider doing your browsing and email in the VM, but the contract work and bookkeeping stuff on the host OS. That way if you get phished, the attack is limited to the VM, and can't do really nasty stuff like encrypt your docs and hold them for ransom.

  • 10
    just make sure you don't share folders or drives between the host and the VM - or if you really have to, just use it as a temporary folder (copy in and move out) – HorusKol Jun 21 '17 at 10:57
  • 11
    Using email in VM and document work in the host without file sharing seems highly impractical. – zakinster Jun 21 '17 at 11:16
  • 19
    @zakinster and security at cost of usability often costs security? Something like that, as far as I remember. – Mołot Jun 21 '17 at 13:24
  • 1
    Are you sure you mean phishing in the second paragraph? Phishing is a social engineering attack. This is one of the threats where a virtual machine isn't offering much protection. – Philipp Jun 22 '17 at 12:24
  • 2
    @Philipp if the phishing attack convinces you to download a dodgy file that then attempts to hold your system for ransom, it will end up holding the guest VM hostage rather than the host VM. If you sign into a fake site though and enter your bank credentials, it won't help against that ;) – Doktor J Jun 22 '17 at 18:59
18

In context of a Windows setup, a hypervisor such as VirtualBox, VMware helps isolate your guest from the host (the main installation of your OS).

This is a considerate move in terms of Security, if you're dealing with activities or files/software that pose a risk to compromise your data. One example would be for Security Analysts, who is analyzing malware on a daily basis.

So, if this is your business computer: It might make sense to encapsulate an installation inside a virtual machine if you ever would lend your computer for someone to use it, download/install unsigned software or torrents, etc. Breaking out of a virtual machine takes some very sophisticated attacks, and is a highly regarded exploit on the 0-day market.

It's the guest you want to isolate from the host and not vice versa.

There is some operating systems such as Qubes (https://www.qubes-os.org/), who does app virtualization - which means that every single application run in it's own isolated instance.

Judging by your description of daily use you are a fairly low risk user.

  • Only open files, e-mails from trusted entities.

  • Have unique passwords, and change then regularly. Monitor leaks from hacked sites you might have registered yourself on through haveibeenpwned.com

  • Always use the latest version of your web browser, Adobe PDF, Java and Flash if you need them at all.

  • Be conservative with browser extensions.

  • Don't install unsigned, outdated or pirated software.

  • Enable 2-factor authentication for your crucial accounts such as GMail, Facebook, etc.

  • Encrypt your backups, if having any (pull).

  • Be considerate with how you choose to split up your virtual machines.

  • Configure your Virtual Machines with none or limited access to folders etc, on your host machine.

  • There is a myriad of software for hardening in Windows such as EMET (The Enhanced Mitigation Experience Toolkit), Microsoft Security Essentials and Windows Defender.

  • If you run a Linux based installation in your virtual machime, I'd suggest you to install a supported release and enable unattended Security upgrades, reboot the server whenever there is a new kernel installed.

These steps will improve the average users information security significantly.

NOTE: Don't forget that the virtual machine, separation only mitigates certain threats and attack vectors. There is a lot more to take into consideration to have all the Security best-practices in place.

  • 2
    Thanks so much guys- I just took a look at qubes and I really think that may work for me. My issue is when I'm hunting for small business leads I usually end up getting tangled up in adware, especially when I'm mentally fatigued. So I'm really just looking for a way to separate browsing from everything else as seamlessly as possible. Thanks again great suggestions – user151357 Jun 21 '17 at 5:53
  • 2
    Suggestion for your last point on backups - make sure you setup a PULL backup on a system that runs headless by itself, and that your main computer cannot access without you initiating an action - an SSH key, or a password. – Canadian Luke Jun 21 '17 at 16:29
5

Usings VMs as a lone security measure is not enough. However, for a security conscious person who's already practicing other security hygiene, using VMs for additional security works well.

Here is how I use VirtualBox for routine daily use. You should consider your use and tailor it for your purpose.

  • Separate VMs for separate purposes. e.g., Documents received from / going to external sources that I must download and use go into one VM. Online purchases and banking into a separate temporary VM.
  • Keeping VMs updated with latest patches / updates is a chore. To keep it to a minimum I use VM templates - VMs that I don't use directly, other than to run updates. I clone these VMs when needed and use the clones as temporary VMs. Delete after use (typically 1hr to 1wk, never longer).
  • As much as possible, leave attachments and documents online (e.g., use Chrome's in-browser PDF viewer / document viewer). This works when you're not worried about document leakage but do want to avoid malware infections from external documents.
  • Use uBlock Origin and uMatrix browser plugins even within the VMs to minimize contaminating the VMs through the browser route.
  • One VM where most "semi-parmanently logged in social media accounts" are maintained. Recycle this VM less frequently than others - about once a month. Be extra alert with this one because of extra risk.
  • Setup Shared Folders to make sure the necessary files are available in each VM, but keep the access to a minimum (only the specific directory that's needed). Over a period, this falls into a pattern and becomes manageable. At first it's a pain.
  • Absolutely no work at all on the host machine. The idea is to keep the host with the lowest risk of all. If that's gone, then everything is gone.

Hope this helps.

  • If you're afraid a malicious PDF could compromise your reader, why do you think it's safe to open with a browser? – Dmitry Grigoryev Jun 21 '17 at 8:54
  • Good point. Exploits are usually software specific. If the browser's PDF reader is targeted, the approach won't work. Yet, if Chrome (and other browsers) implement their sandboxing well, there is still that extra layer. – Sas3 Jun 21 '17 at 9:11
  • FYI, PDF readers use sandboxing as well. – Dmitry Grigoryev Jun 21 '17 at 10:07
  • 1
    @DmitryGrigoryev Adobe Reader has a longstanding and well earned reputation of being highly insecure with little apparent concern from Adobe. Chrome contains a hardened PDF reader in a sandbox environment that is well regarded. Many online cloud services actually display PDFs converted to images as well. – trognanders Jun 22 '17 at 22:16
  • 1
    @DmitryGrigoryev I actually do think that Adobe has cleaned up their act with respect to security significantly in recent years, and trust their products much more now. The better updater for Reader was a huge step. Chrome is a very popular piece of software as well with a more venerable and proven sandbox environment. – trognanders Jun 23 '17 at 23:55
3

A short answer here : if you're doing everything inside a virtual machine then the risk is exactly the same as if you were doing everything outside of it. If your virtual machine get compromised, then you lost everything but your computer.

As others stated, you should only use a VM for some stuff, especially for work requiring access to risky websites / ressources / the internet in general. In this way, you limit some risks on what you have on your computer outside of the virtual machine.

However, keep in mind things like downloading a ressource in your virtual machine before running it on your own computer (like a PDF with potential malicious macro) are not 100% secure. Some malware were designed to evade sandboxing solutions, so that they only trigger when they are outside of a virtual machine / test environment.

1

what do you want to secure yourself from? - schroeder

If your answer to this question would be something similar to:

I want to protect my business from people that may be determined enough to cause damage or steal my contractual and research documents that I keep in my computer.

Then using qubes, as mentioned by William in a previous answer, virtualizes the apps that are used to access those same documents, thus reducing most attack vectors that may be caused just by opening them.

Many people use Windows with the default Admin account and/or have UAC settings on a low level. If this is your case, there is perhaps a tiny possibility of one of your "well intended" and more determined "clients" to send you an unconspicuous word/excel document, produced by a "friend who can do wonders with documents", that when opened on your Windows 10 executes macros, causing a silent and "lethal" strike.

If your computer does not have the minimum requirements for qubes or you just feel it's too much trouble to go for it, then I would perhaps reverse John's suggestion, in the sense that you should only keep, access and modify your documents in an encrypted VM with a frequently updated linux OS (limiting the possibility of these attacks) while shredding the documents from your Windows OS.

Backup this VM image frequently and if you want to go a bit further then use another VM just for accessing your mail and work websites (as SaS3 suggested) and transfer your documents through a shared flash drive or folder whose files you shred after your daily work.

  • 2
    this looks like a summary of all the other answers – schroeder Jun 22 '17 at 21:17
  • Thank you for your previous comment @schroeder. I'd agree except none of the previous answers mentioned macros, VM encryption, exclusive storage and manipulation of documents in a VM and, especially, that data/business-sensitive risks may directly come from clients. – Armfoot Jun 22 '17 at 22:29
-1

If you have a business were the uptime is critical I recommend an hypervisor such as ESXi or XenServer where you can can have separate VMs for different purposes and manage networks inside of the hypervisor. For the VMs inside the hypervisor to communicate with the outside world (rest of the Internet) I recommend a Firewall, for example PFsense, that works as a Firewall/Router for the internal networks you may have in the hypervisor.

If you want to go really big and provide maximum uptime as possible, I suggest 2 physical machines with a bridge connection between them, have a hypervisor on each computer (from the same company for compatibilities purposes) and with a live migration system in place in case something happens, for example not enough memory or a computer has lost power but the other is alive. What the live migration does is the hypervisor migrates (transfers) the VM still on to the other computer and keeps it on at all times. It's really cool.

  • I feel like this is not really answering the specific situation mentioned in the question. As the question says "I run a small business out of my home...", "I just bought a cheap laptop...", etc. Somehow I think suggesting enterprise-level solutions, with multiple servers for physical redundancy, isn't really tailored to this particular question. – D.W. Jun 23 '17 at 0:26
  • Haha and of course a 2 drives in Raid 1 + a backup per machine :) – Dinaiz Jun 23 '17 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.