VirtualBox + VPN with Win10 Host - how secure is it?

Question

I got a notebook running Windows 10 from my company which I am officially allowed to use privately. I have to travel a lot. I don't want to carry a second notebook. Since the admins have access to the device, like for company administered browsers, updates or whatever, I don't want to use it without an extra layer of protection from their monitoring.

So I installed VirtualBox with a Mint OS guest. The virtual drive is encrypted. Inside the guest system, I installed mullvad VPN.

How safe is this setup? Is there any possibility to check if there is maybe a keylogger or something like that running in the host system compromising my security? Where are the potential pitfalls of this setup?

I don't want to use it for illegal things (of course) but I don't want my company to be able to read private emails, chats, know my account balance when I check my credit card bill abroad, see what I watch on Netflix or whatever, see what I shopped and stuff like that.

What's your opinion on that?

Answer 1

Security and Privacy is a relative thing. The configuration you describe is pretty solid and is likely sufficient for most situations.

However there are less likely possibilities that can effectively defeat the described configuration. You mentioned one already, “Key Loggers”. Another is a host level process that can access the running unencrypted virtual system once you start it.

It’s unlikely that a legitimate company will deploy the kind of extreme level surveillance necessary to thwart your approach, but it’s technically possible. It’s far more likely that admins will note your encrypted virtual disks and ask about it, as well as your use of a VPN. If a response of, “Personal Stuff” would be acceptable, then your protections are likely sufficient.

If you are concerned about the less likely more extreme monitoring potential, then an external bootable OS that completely bypasses all corporate software is necessary.