Encrypting a VM and folder

Question

Problem: I have a VM that I want to use to store extremely sensitive data.

What I would like to have: Full VM encryption, as well as encrypting a specific folder on the VM so that it can only be opened if a specific machine has a specific certificate on it, or access to the encryption key.

Question: Is it possible to encrypt a whole VM, and then to encrypt a folder inside of said VM to only allow access when certain conditions are met? If someone were to get a hold of the VHDX file, mount it and start it, would this prevent them from gaining access to the folder?

(The VM is Server2012 R2, on a virtual host that is unencrypted and running server 2012 (NON-R2), but extremely utilizes extremely strict ipsec rules)

Answer 1

I've been in similar situations and have always solved them succesfully with this approach:

• My host OS is Windows 7 64-bit
• Most of the time the guest OS I use is Ubuntu, but this should work fine for any other guest OS, including Server 2012 R2. Make sure the virtualisation software you use fits your guest OS well.
• In my case, virtualisation is done by VirtualBox. Again, this should work fine with other virtualisation software, as long as you keep an eye on the location of your VM files.

First, I set up the encrypted container that I'm going to use to store my VM:

• I create a new TrueCrypt container with a fixed size that is large enough to hold the installed guest OS and the sensitive data you need to work with.
• Do not create a 'dynamic' container, because they are less secure, and have less performance. (source: http://www.truecrypt.org/docs/creating-new-volume)
• If VM performance is an issue, you may want to choose an encryption algorithm that faster in encryption/decryption. If you fear a heavy attack on the encrypted volume and performance is not an issue, make sure you select a combination of three algorithms.
• Take care in selecting a strong passphrase, keyfiles, anything required for a safe container.
• Mount the container after creating it, you will need it immediately for the next step.

Secondly, I set up the VM itself:

• While setting up the VM, take care in making sure the new VM configuration, AND the hard drive image(s) are writting DIRECTLY to the TrueCrypt container. If you write the VM config and image to your (unencrypted) hard drive first, you will risk leaving traces of the install on your disk, even after moving the files to the TrueCrypt container.
• Take the same care in selecting the folders for the snapshots for this VM, and all other files or directories related to the VM you're about to create.
• Close your virtualisation software. Unmount the TrueCrypt container. Start the virtualisation software again and check to see how it responds to the suddenly 'missing' or 'unavailable' VM you've just created.

Considerations when installing the guest OS:

• Because the VM is inside a encrypted container, you can simply apply any guest OS-based security and encryption you would like as a second line of defence.
• This includes setting up an encrypted container inside the VM, or using encrypted homedirs on Ubuntu, or Windows EFS.

Hope this helps.

Answer 2

WM exists on your disk as a file and you can simply encrypt it as you're encrypting other files. To encrypt the folder, you can try truecrypt or encfs.