1

I started working at a large financial institution several weeks ago as a software engineer and despite every other aspect of this job being great, I am haunted by the constant restrictions that workstation security policy here puts us through. We are not allowed local administrator rights on our Windows 7 workstations which is normal and I agree with. What is more of a concern is that we are only allowed to use software on these workstations that has been approved and added to our Advertised Program list. Being on a greenfield project and working closely with a vendor to get a POC off the ground, this process is too slow and sometimes prevents us from doing our jobs.

I know that other teams have run into this issue and I am unsure how they tackled it, but apparently it is a battle that has already been fought and lost by several groups, even for exceptions to be granted.

I am preparing a document that seeks to demonstrate how if we were allowed to run VirtualBox on a Windows 7 workstation that we can get all the benefits of local admin rights while not causing any undue security risks on the machine or network. I know they are going to look for the easiest way to dismiss my proposal so I am trying to rebut in my document any security concerns that this group might have.

Are there any significant security concerns that are introduced by the introduction of local virtual machines on a restricted workstation? If so, how can such security concerns be mitigated?

My apologies if this question is too broad or posted in the wrong place.

  • Will you have network access on this virtual machine or not? – Paul Jul 29 '14 at 11:51
  • @Paul Yes. Network access. – maple_shaft Jul 29 '14 at 14:14
  • 1
    Feel free to ask for more info if your question isnt answered. Otherwise, consider accepting an answer :) – Matthew Peters Nov 6 '15 at 12:38
  • @MatthewPeters Thanks for reminding me. I accepted your answer. Just an update, my proposal got some managerial backing, however I faced many many roadblocks and redtape for months to get a 15 minute audience with an architect of desktop infrastructure. He seemed ambivalent to the idea, put a bunch of open questions that need to be answered by the security team then shoved it in a drawer somewhere knowing that Security is too busy constantly fighting fires to give it much attention. Just a very reactionary company that is too stressed to be proactive on anything. – maple_shaft Nov 6 '15 at 12:43
  • 1
    idk which company you work for but this is unfortunately typical of too many... The best thing to do is to personally learn from it so that when/if you have the ability to make the decision, you can make the right one. Oh and at least you've documented that you see a problem. In the corp world, CYA is a big deal (again unfortunately)... – Matthew Peters Nov 6 '15 at 12:48
3

Technically speaking there is very little risk in running an insecure VM on a secure machine IF that VM does not have network access (after all this is how you research malware). If it does have network access then you've essentially just circumvented all security safeguards.

From a security perspective, assume that your VM will be insecure and thus full of malware (let's just assume). If you have the VM completely isolated from the outside world and therefore your own system, it's perfectly benign. This is akin to a proper biological lab with a hot agent -work gets done, people go home, no problems. If you were to have network access to that VM, it's akin to that same biolab but leaving the doors open.

As a developer, I constantly run into problems like this and to be honest, changes/exceptions like this generally are not a decision your employer can make. The security policies are devised when the contract is created. You just have to do your best to work within them.

As per your comment, there are no real secure ways to truly 'limit' the VMs network access because it is inside the host PC (and thus its network). At the VM level there are very strict (not invulnerable, but strict) methods in place to prevent network access if you deny it as setup. If you choose to enable say a certain port during setup that introduces so many vulnerabilities associated with that port.

As you stated, your company allows you to RDP to your machine at work. While personally, I find this a huge security risk, this does give you some options...

The simplest option is to simply RDP out to your machine at home and do some heavy unrestricted lifting there.

None of these methods are the most efficient for a programmer nor are the security policies in place to make things easy.

I would suggest opening a dialogue with your employer and outline your frustrations. If there is something you need and do not have then that is a legitimate concern. In the world of contracting there is very little room in negotiating just how tasks are done.

  • I am unsure what you are suggesting then, that I quit and find a new job? I just want to be able to do my job the way a developer is REQUIRED to work. There really isn't a gray area, it is a black and white issue. Do you want me to be a highly paid cube occupier or do you want me to design software. – maple_shaft Jul 29 '14 at 14:10
  • Can you think of a way to limit the VirtualBox network adapter such that it can only reach specific network resources and software environments needed to develop software? On this same note we are allowed to VPN in from our home computer when working from home. Wouldn't it stand to reason that my virtual machine is no less secure than my home computer when working from home? – maple_shaft Jul 29 '14 at 14:11
  • 4
    @maple_shaft, I'd say the vast majority of the workforce performs tasks we do not enjoy, but that's a different matter entirely... As for your technical comments, I will update my answer... – Matthew Peters Jul 29 '14 at 16:34
  • I would add that most people, if not everyone, has arbitrary restriction placed on how we do our work that almost always makes it harder to do what we were hired to do. I tell myself it's because mine is not the only job that has to get done, and some other's tasks require making my tasks harder to accomplish. – Todd Wilcox Sep 5 '14 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.