0

I want to work on a project that has some sensitive data.

My plan was the following:

  1. Make a virtual Linux machine
  2. Use disk encryption on this machine
  3. Work on this machine without the internet connection

Should my host be compromised after the project is done, will the attacking party be able to access the files on the VM?

1
  • if the VM is encrypted, then, yes
    – schroeder
    Aug 31, 2017 at 16:47

1 Answer 1

1

If you are not 100% certain that the Hypervisor host is clean, then the VM can be compromised even if the VM is running disk encryption. (Eg. your keystrokes can be captured rending the disk encryption useless.) The only way to be certain that the host is clean is by using a MD5-hash verified OEM installation source and not using any third-party software on the PC. (Not even web browsing.)

If you have a clean install of the hypervisor and disconnect the internet from the hypervisor you cannot get malware unless you introduce it with a flash drive or other external media. After reconnecting to the network, if you never access the VM again the attacking party will not be able to access the files on the VM. (Even if you got malware on the hypervisor after the fact there are no keystrokes to be captured to circumvent the disk encryption on the VM.) They would have to resort to brute-forcing the private key.

For domain administration (another very sensitive task), Microsoft recommends you have a physically secure workstation that has nothing enabled on it besides RSAT for domain administration. You do all of your web browsing and other day to do stuff inside of a VM on the physically secure workstation, not the other way around.

More information on Privileged Access Workstations (PAWs): https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .