I have a decently powerful desktop running Windows that I use for 2 different use cases: playing games and storing/processing my personal data. As a security-aware person this makes me uncomfortable. A vulnerability on Steam, as I think has happened in the past, or any of the games themselves, can put my personal data at risk. I'm not a security expert by any means, but I have come up with a few options, and I'm not sure which one to go with. I'm not sure which one provides adequate security, so please let me know your thoughts. Here is a list of approaches, somewhat in order, from lowest effort/lowest cost:
- Running the games in Sandboxie - is this secure? Would they even run properly?
- Separate Windows user accounts, making sure the account for playing games is not an administrator account. If this is good enough, what else do I have to do?
- Combination of #1 and #2
- Dual boot, so I'll install Windows on a separate physical drive - each Windows instance will be separately BitLocker-encrypted with different passwords (I don't have a TPM chip on this PC), and somehow not allowing each instance access to the other's drive - how, exactly? I have no idea how to achieve that, other than physically unplugging them in turn. This is the method asked in this question > Isolate two hard drives with two operating systems. If total isolation is not possible, will BitLocker prevent data access and meaningful modification? Can malware on the game drive somehow infect the other drive even when encrypted? I am more concerned about data theft, so if malware infecting the game drive wipes out the other drive but can't access any of the data and can't infect the other Windows instance, it's a pain but still better than data theft, as I have data backups available, but if that's the case I need the data corruption to be immediately detected/noticeable.
- Running the games in a VM - I have never tried this, I know this is possible and I have both an integrated and dedicated GPU, but I'm not sure my technical skills are up to the task of PCIe passthrough of the GPU, etc. I have only ever run "basic" VMs.
- Building a separate machine entirely - I know this is the most secure way but it's one I really would like to avoid.