Full Disk Encryption within a VM, how secure is it?

Question

Just a quick query on basically how to secure a VM for a home computer for a number of uses (such as securing work related data in a good enough fashion whilst in its native environment).

I'm not looking for absolute top notch security, otherwise I wouldn't be looking at this for a home computer. So for the Work scenario, I'll be using a VPN within the VM to connect to the office network. I just want to make sure the data within the VM is properly isolated from the host OS, so getting to the data is much harder than it normally would be.

Would simply enabling Full Disk Encryption in the guest OS within the VM do the job for this? Might I need to bother with wrapping the VM images in a TrueCrypt container? Like I said, I'm not looking for super top-notch security, just for a good enough solution that doesn't expose my data needlessly. The Host OS itself is not encrypted for now, but that might change. I fully expect that given enough time, resources and willpower, anyone can and will get to that data. I just want to make it so that there are enough barriers to discourage or prevent most attempts, or delay considerably any attempts to gain access.

The fact that there is a VM on my machine doesn't need to be disguised, since I'm not necessarily looking for plausible deniability, etc. I'm not THAT paranoid!

Answer 1

To protect your VM, you really have three options. Each of them is probably equal to the other in terms of security, provided that you use them properly.

1. Whole-disk encryption within the VM.
   • Never save the VM machine state - always shut it down completely.
   • Do not use the host system's sleep, suspend, or hibernate functions while the VM is running.
2. Wrap the VM files in a TrueCrypt container.
   • Make sure to only open the container when you need it, and close it when you're done.
   • Do not use the host system's sleep, suspend, or hibernate functions while the container is open.
3. Whole-disk encryption of the host system.
   • Do not use the host system's sleep or suspend functions - always hibernate or shut down.

Each of these can be used independently or in conjunction with any or all of the others. However, keep in mind that multiple layers of encryption may begin to significantly impact performance.

Personally, I would start with option 3. If you don't want to go that route, or you want to add another layer of security (e.g.: have a different encryption key for your VM than you do the host, on a multi-user host system), I'd pick option 2 next.