1

The environment

Our company has a reasonable (from the point of view of a regular employee) security policy consisting of, among other things:

  • Sophos suite covering both local antivirus solution and Internet access screening (corporate proxy with a MITM proxy for https),
  • Windows 10 with disk encryption,
  • automatic log out (lock) timer per domain policy,
  • central control of installed software (both installations and compliance checks of user-installed sowftware),
  • no single-sign-on, very few if any mandatory programs continuously running,
  • users can be local admins (devs and such) but can't override domain policies (like the automatic lock after preset time),
  • VPN access for field workers.

In place are legal measures as well, like non-disclosure agreements signed by every employee.

Users have full physical access to their machines (from plugging USBs to opening the box and fiddling with stuff, though usually nobody does the latter).

The question

Given the situation described above, is it reasonable to assume that giving an employee a Virtual Appliance for a common virtualization environment (VMWare, VirtualBox, KVM...) is no different than giving them a laptop with same configuration to work remotely? The VM would be run either on a throw-away computer or the employee's private computer*. Am I missing something important here which would disqualify the VM run on arbitrary hardware?

One thing I can think of is poorly secured VM host on which a malware program (for example a keylogger) can sit between the user input and the VM, which would not be the case for a better secured physical computer (but admittedly would work with a remote desktop from said poorly secured computer). I'm interested in possible problems like this one.

1

There are considerable differences once you begin to look at support, help desk, patching, upgrades, lost hardware, incompatibilities with security settings or applications on the personal hardware etc...

I'd suggest if they don't offer this the best you can do is ask if they will consider it. They may implement a solution that works for you, if it makes sense for them to do so.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.