Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'll have to deploy virtual machines on demo laptops, which will use Vmware player, but I've got some security concerns, as some data stored in the virtual machines are a bit sensitive.

Is there a way to prevent the copy of these virtual machines ? Are the virtual hard drives encrypted, and if not is there a way to encrypt them ? In short, is there a way to lock down everything so that nobody could copy and or use these VMs in another computer ?

EDIT :

Truecrypt to encrypt the VM could be a solution, but if the password used by truecrypt is leaked, then it becomes useless. Associating the VM with a computer so that it can only run on a specifica hardware should do the trick, but I haven't found a solution that allows me to do that...

share|improve this question
    
You're making it sound like you don't trust your users. If that's the case, you're fighting a lost cause in securing this...? –  Bart Silverstrim May 3 '10 at 14:37
    
Are you securing it from your own users, or from thieves? –  Bart Silverstrim May 3 '10 at 14:37
    
Both in fact. I'd like to be able to prevent a thief to steal my data, and deny the possibility for my users to be able to steal it as well... It's not that i don't trust them, but you never know what can happen... –  Florent Courtay May 3 '10 at 14:48
1  
The trouble is that any user with authorized access can steal from you; it's a security weakpoint. It's like malware. You can secure systems up the wazoo; it won't prevent a worm or malware from gaining access to a users session and attacking their home directory files, which if it's your HR guy (for example) will leak sensitive data, because his account has authorized access. You have to trust your users and let them access what's appropriate for their job or you're just creating hassle for yourself and them. –  Bart Silverstrim May 3 '10 at 14:52
    
Setting it up so that your guys doing demos of this software (or whatever your situation is) aren't allowed to do just about anything with these laptops and adding cumbersome layers in the name of security is a good way for you to end up in a Dilbert cartoon. My advice is to give them access to only what is needed for their jobs and trust them, otherwise someone made poor hiring choices or you're cultivating a culture of distrust and frustration at their IT department. –  Bart Silverstrim May 3 '10 at 14:54

4 Answers 4

up vote 2 down vote accepted

Three suggestions and a comment ..

S1- Reconfigure the demo to minimize (or eliminate) the secure data available. THIS IS THE BEST APPROACH.

S2- Avoid the issue by giving the demo laptops mobile broadband so that they can connect without plugging in at the clients. At that point, there are a ton of very secure methods to connect (VPN, Terminal Server, GotoMyPC, and so on). It is likely more cost effective than building secure, inconvenient laptops that you have to manage and deal with frequently.

S3 - If neither of these works for your organization, you could use TrueCrypt with a YubiKey, inside a VM or not. Then if the password is leaked, the data is still secure.

Comment: Once you give someone access to your data, it is as good as gone. They can take screen captures, print, take pictures with their cell phone, take notes, memorize key items, etc. In my experience, there is a quickly diminishing return on the ever more onerous and inconvenient methods to crank down on possible leaks at the client. The cost goes up, the effectiveness goes down, and the inconvenience gets out of hand. IMHO the best approach is to plug the reasonably common leaks at the core, restrict access until trust is established, and accept the permanent risk that people you trust may not be trustworthy.

share|improve this answer
    
I really like the "Truecrypt with a yubikey solution". Almost transparent for the user, and associating the VM with a physical device answers a lot of my concerns :D Will be flagged as answer if nobody provides a better solution ! Thanks ! –  Florent Courtay May 3 '10 at 16:28
    
@Florent Cool, glad to help! –  tomjedrz May 3 '10 at 22:25

I'm not aware of a VMWare-specific solution to your question, the virtual disks themselves aren't encrypted but obviously there are guest-specific systems that will prevent unauthorised access but if you copy the disk it'll still have the same contents. I guess if you're using Player/WS/Server you could place the virtual disks inside something like bitlocker and apply copy-rights access priviledges but that would depend on your host OS type.

share|improve this answer
    
The original idea was to use VMware player for windows to run the Vms. Bitlocker is a really good idea, but if the password is leaked, it's almost like if it wasn't installed at all. It's not that i don't trust the users, but hey you never know ! –  Florent Courtay May 3 '10 at 14:36
    
If security really is paramount then I'd suggest you simply setup a centralised VM host with the ability to RDP/VNC/whatever out then get the laptops to RDP in - over a VPN if you have to. –  Chopper3 May 3 '10 at 16:36
1  
vmware ACE is specifically designed for this sort of use-case. –  chris May 3 '10 at 23:10
    
+1, good job :) –  Chopper3 May 4 '10 at 11:01

I know of no way to secure the images in a way that goes beyond what is already built into Windows (assuming that's what's in the VM's you're using).

My question for you involves deployment; if these are demo laptops, what are you putting on them that is sensitive? I mean, what scenarios are you specifically trying to protect against? If you weren't using VM's, they could still have data stolen. You would have to use Windows (or Linux) encryption on the filesystem to keep thieves from gaining access to data, and that is again something you can enable within the guest OS.

If you're using some demo software that is using sensitive data, you might want to reconsider doing that. With laptops, you have only as much protection as you trust your users, as all the encryption and measures in the world won't keep an authorized user from screwing you or your company over. On the other hand being overly restrictive or adopting cumbersome practices will generate a lot of ill will towards your company and your department from your users.

Also be aware that adding an encryption layer can add overhead to the notebook; you'll be running a virtualized system (which is some percent slower) to an encryption layer (which adds overhead and thus makes it slightly slower), so that can impede performance. Something you'll want to test.

From what you described, I'd probably use your guest OS's built-in security to encrypt things as necessary to protect the data you're worried about, or use an encrypted volume on the drive or USB drive (something like Truecrypt) or use such a tool to encrypt within the guest to secure information. Best bet is built-in tools like Windows encryption on NTFS, otherwise Truecrypt. And any other security you can use on the laptops (like BIOS settings changes appropriately).

share|improve this answer
    
The problem is some customers don't allow internet connections, so a demo laptop is kind of mandatory... –  Florent Courtay May 3 '10 at 14:50
1  
All the more reason not to make it more cumbersome. Do you want your sales guys (making assumptions here) to go into the field to have something fail because of restrictions added to the laptop? More complicated you make it, the more chance you're summoning Murphy to drop in and pay you a visit. Keep it as simple as you can while achieving your goal. –  Bart Silverstrim May 3 '10 at 14:58

You want vmware ACE.

It is like vmware player but the images are encrypted by vmware itself. You can do things like set expiration times and passwords and remotely disable / delete virtual machines.

Now, how this all would hold up against a concerted attack against one of your virtual machines? Probably not well, but it would be better than distributing normal virtual machines with no protection.

share|improve this answer
    
+1 for using the right environment. –  Avery Payne May 3 '10 at 18:33
    
"VMware has announced the end of availability (“EOA”) of VMware ACE, effective on December 31, 2011. No further orders for VMware ACE will be accepted after this date. VMware has also announced that all technical support and maintenance services for VMware ACE will cease on December 31, 2013 (“EOSL Date”)." - vmware.com/products/ace/overview –  Zitrax Jan 13 at 20:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.