The scenario is a lightly secured home or work PC used primarily for low-sensitive operations. For more secure activities a pre-built and restrictive virtual machine will be used.
I'm mostly concerned about data theft and/or modification via unauthorized/unattended access to the host machine while the VM is powered off.
For mitigation, I want to encrypt the VM image, and it seems there are three general choices:
- Use VeraCrypt or another on-the-fly encryption package to encrypt the partition or folder where the guest VDI will be stored.
- Use VirtualBox's or VMWare's built-in encryption to encrypt the guest image.
- Use full-disk encryption within the guest OS (e.g. LUKS for guest Linux or BitLocker for guest Windows)
What are the security factors or tradeoffs between the three? Is one generally more secure or more tested than others?
It seems like 1 and 2 might amount to the same thing. I know VeraCrypt has been audited, and LUKS seems pretty well-tested, but not sure about the encryption build into VM software.
note: This answer is for a similar question, but the answer does not address the trade-offs between the three choices