2

I work as a developer in a security heavy finanical services company. As a group we are finding that our Windows 7 workstation security policy is preventing us from performing our jobs. We do not have local administrative rights on our workstations and can only install/use software from an Advertised Program distribution list. This security policy cannot be changed and it was made clear that exceptions are being made for nobody.

I am trying to make a case for allowing developers to use VirtualBox on local VM's. I am sure that they will have a problem a virtual machine that is not Host Only or Internal meaning we couldn't access our various environments in our internal network. Outside internet access isn't necessary from the VM. They are going to state this is insecure because malware could be installed on a local VM that then infects the corporate network.

Since I am preparing for negotiation:

What I REALLY Want

We currently have a VPN token that we can use Cisco Connect on our fully insecure home computer to VPN into the corporate network on a somewhat RESTRICTED subnet. If we could set a Bridged Network connection from our local VM to this VPN network adapter and ONLY THIS VPN NETWORK ADAPTER then I feel this might be an adequate solution. Our local VM could not be any less secure than a home computer. The standard corporate network however I would like the option for this to be disabled or unavailable to VirtualBox at install time. Is this possible and if so then how?

Here is what I will settle for

If I can set up a Host Only network in VirtualBox, then is it possible for us to set up reverse port forwarding such that Guest OS can reach specific internal corporate network resources with Host being a proxy? Is this possible in VirtualBox alone or would this need an additional proxy to be setup?

Furthermore, can VirtualBox be installed with NAT and Bridge networking disabled so that only Host and Internal network adapters can be created?

I appreciate any insight into how this can be achieved.

  • This security policy cannot be changed - Sure it can, it's not a property of the universe. Find someone with enough power who will gain more power by changing it. Talk to them. Show them a financial incentive in terms of developer time wasted. – TessellatingHeckler Jul 29 '14 at 18:45
  • You're in luck, bellard.org/jslinux a no-install VM that runs in your approved browser. ;) – TessellatingHeckler Jul 29 '14 at 18:53
  • @TessellatingHeckler Well I am generalizing a bit and I am actually trying to get smart and influential people together to talk about this, but it is one of these problems that is akin to dismantling a roller coaster single-handedly with only a screwdriver. It is arduous, dangerous and takes a very long time to be successful. – maple_shaft Jul 29 '14 at 19:29
  • @TessellatingHeckler Also, I am not in luck apparently since the corporate standard and only approved browser ATM is IE8 and it doesn't appear that this site works on this ancient and embarassing browser. :) – maple_shaft Jul 29 '14 at 19:36
2

As an alternative: Why don't you just set up a bunch of developer machines on a seperate "developer" subnet? These could be virtual machines, and the users could use Remote Desktop or SSH (depending on the platform) to reach them, and be able to do their job. They may well be allowed access to the Internet, and only be allowed to talk to the corporate network as much as is required for them to be RDPed into from there.

I think you'd find this to be fairly inexpensive to do (a single server may well be sufficient) and you could involve your network and security team to ensure that this environment is properly sandboxed.

The free edition of the VMware ESXi Hypervisor or Hyper-V in Windows Server would probably fit this use case quite adequately.


As a variant on this plan, if you really don't want to involve your IT department to make changes, there's nothing saying you have to involve them at all. Instead of installing the developer software to run on a server physically on premises and as such under the jurisdisction by IT, you might have more luck using a Cloud VDI solution. Googling Cloud VDI, I found that Amazon has recently launched a service called Amazon Workspaces which after looking at it for like 30 seconds seems like it could be what you want.

As for interconnecting these Cloud VMs with your corporate network, there are a couple of approaches you could take. The cleanest solution (unfortunately, requiring IT's blessing) would be to set up an IPsec VPN link using Amazon's Virtual Private Cloud (VPC) service. They could then set up a tunnel to these servers and lock them down appropriately. If you really don't want to involve IT, you could just see if you could install your existing VPN software. You really don't want it to redirect its default gateway in a scenario like this, though, so if your VPN client makes the client route default through the VPN, this would need to be fixed.

If you run into a roadblock because of it being "in the cloud" and therefore unacceptable from a security standpoint, you could also put up your own server in a colocation facility, get dedicated hardware and run your own VDI solution, but this would seem to be a lot less flexible and involve a lot more work.

  • A sound idea, but the point of developer agility is trying to cut out the need for IT requests and their sometimes 30 day wait times (outside of test, QA and Production environment setup). Something akin to what you are suggesting would involve getting a significant amount of their time and this could take many months. – maple_shaft Jul 29 '14 at 19:39
  • I hear where you're coming from. But there's a rather big problem with your plan, which is that locking down network access from the virtual machines involved will be difficult at best, and there is no clear path to follow (as evidenced by your question), introducing risk. Your suggested method of running the VPN client in the host machine and then bridging the VPN adapter has me dubious regarding to whether it would work. Since you seem intent on wanting to do an end-run around your IT people, I've edited the post, with a similar approach that doesn't require IT to be involved at all. :-) – Per von Zweigbergk Jul 30 '14 at 5:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.