I am pursuing malware research and am wondering what are the best practices for building safe VM's to contain the code while disassembling it. So far:
- Each instance for examining the code is housed in a seperate VM with host-only network support to prevent hostile code from escaping the VM.
- Each VM is fully patched and has a minimal attack surface by excluding all unnecessary software/services.
What other steps should I take to isolate the VM's or harden the VM's ? The VM's are Win XP and Win Vista.