I’ve been issued a work laptop with Windows 11, running the Sophos Endpoint Agent, which monitors all web traffic and processes running on the PC and blocks malicious stuff.
If I install a Linux VM on it and access the web from inside it, will the Endpoint Agent see what I’m doing and be able to block access the same way as it does on the host?
I guess what I’m asking is, how does accessing a website from inside a VM work, actually? Does all the traffic get routed through the host OS unencrypted?
The purpose isn’t to try to circumvent any security measures or go over the heads of the IT department, but rather to find out if I can make a case for using my favorite OS on this thing without compromising security.
Consider it non-secure for personal stuff. Consider the possibility of full monitoring. They may not see the contents of encrypted traffic from the VM, sure, but there’s still a possibility of keylogging and even screen monitoring, possibly something else.
To answer your question, the guest OS should reject the security software’s certificates, should it attempt MITM. Otherwise there wouldn’t be much of a reason to use HTTPS over plain HTTP.
It can still do blocking I guess.
Secondly, it’s a work device, and that software is there for a reason. Trying to get around it may have different results. Your employer might not care much, or they could assume something malicious on your side, and fired you are.
So don’t use it past work-related use cases, don’t borrow it to kids nor anyone else. That bit of hardware is most likely not worth the risk.