@gen843620 wrote: All our Macs run FileVault. Good choice! What are the security risks of running an unencrypted Windows 11 VM in a FileVault environment? Essentially none, since the fi...
See more...
@gen843620 wrote: All our Macs run FileVault. Good choice! What are the security risks of running an unencrypted Windows 11 VM in a FileVault environment? Essentially none, since the files are encrypted on the host. This is my recommendation - encryption on encryption is a substantial performance hit. FileVault protects against the risk of physical theft (along with our locked Mac Mini cage mounts). The only risk I can imagine for an unencrypted Windows 11 VM in that environment is if a hacker or in-person rogue user gained access to the Mac side, then copied the VM over the internet or onto a flash drive. They'd be able to open the VM copy later and access the content. Is that correct? Are there other security risks in that environment? Correct, but if they have that access to your machine, the can also get anything off the host, and you have much larger problems. All our TimeMachine backups are encrypted. I've already decided to only switch to network bridge mode to print then switch back to NAT mode to keep any remote intruder in either system from using the network to access the other (especially any intruder in the Windows VM accessing anything on the LAN). We don't web browse at all from the Windows side. If we need any a Windows program, we download it onto the Mac side then drag it over to the Windows VM or place it in a small VM-shared folder -- both rare. It seems bridge mode is more of a security threat than an unencrypted VM in a macOS FileVault environment. What do you think? For secure networks, it's negligible. For public networks, NAT provides an additional level of protection, in that the entire VM network stack is also behind the Mac firewall. Regardless, make sure the windows firewall is on. If you're in a data center environment, there really isn't a big difference between the two, unless you're worried about east/west movement through the VM's. I have to decide if I'm going to train users to switch back and forth between bridge mode and NAT. The switch in either direction takes 12 seconds on Intel Macs I've tested so far and doesn't require restarting Windows. It's practical if users rarely print, which is our case. But I don't want to handle calls for print failure because someone forgot to switch to bridge mode, though a simple text reply would straighten them out. I'm probably going to leave them in bridge mode since they don't web browse from Windows and the risk of infection is very low. But I'm not thrilled with the risk of Windows and existing Windows programs probing the LAN. C'est la vie. One other option, similar to install, is to print to PDF in the VM, then drag/drop to the desktop and print from the mac.