Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to work on a project that has some sensitive data.
My plan was the following:
Should my host be compromised after the project is done, will the attacking party be able to access the files on the VM?
If you are not 100% certain that the Hypervisor host is clean, then the VM can be compromised even if the VM is running disk encryption. (Eg. your keystrokes can be captured rending the disk encryption useless.) The only way to be certain that the host is clean is by using a MD5-hash verified OEM installation source and not using any third-party software on the PC. (Not even web browsing.)
If you have a clean install of the hypervisor and disconnect the internet from the hypervisor you cannot get malware unless you introduce it with a flash drive or other external media. After reconnecting to the network, if you never access the VM again the attacking party will not be able to access the files on the VM. (Even if you got malware on the hypervisor after the fact there are no keystrokes to be captured to circumvent the disk encryption on the VM.) They would have to resort to brute-forcing the private key.
For domain administration (another very sensitive task), Microsoft recommends you have a physically secure workstation that has nothing enabled on it besides RSAT for domain administration. You do all of your web browsing and other day to do stuff inside of a VM on the physically secure workstation, not the other way around.
More information on Privileged Access Workstations (PAWs): https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations
