Virtual Machines: Build a Boundary Before the Lab

Cybersecurity labs need a place where students can observe systems without turning the school network into the experiment.

One common tool is a virtual machine, or VM.

A virtual machine is a software-defined computer that runs as a guest inside another computing environment.

A simplified model looks like this:

physical computer → virtualization layer → guest virtual machine

The VM can have its own operating system, files, users, processes, and virtual network interfaces even though it shares physical hardware with the host environment.

Host and guest are different systems

The host is the physical computer or platform providing resources.

The guest is the virtual machine using those resources.

If a classroom VM shows:

student@ubuntu-lab:~$

that prompt describes the guest environment. It does not automatically describe the Chromebook, server, or physical computer underneath it.

That distinction becomes important when you collect evidence.

A file inside the guest is not automatically a file on the host. An IP address inside a virtual network may not be the address of the physical device.

Virtualization is not a magic safety shield

A common mistake is:

"It is in a VM, so anything is safe."

No.

A VM is one isolation control. Its safety depends on configuration and on the actions being performed.

Important boundaries can include:

• network access
• shared folders
• clipboard sharing
• USB passthrough
• host integration tools
• user privileges
• snapshots and restore points

If a VM has unrestricted access to real networks or host files, the lab boundary may be much wider than students realize.

Read the lab boundary

Before using a course VM, identify:

Approved target

Which VM, file, service, or synthetic dataset is part of the exercise?

Network boundary

Can the VM communicate only with itself, with other classroom lab systems, or with the wider internet?

Shared resources

Can the guest access host folders, clipboard contents, or removable devices?

Reset method

How is the VM returned to a known-good state?

Evidence path

Where should screenshots, terminal output, or reports be saved?

If you cannot answer those questions, the lab is not ready yet.

Snapshots and known-good state

A snapshot records the state of a virtual machine so that the lab can return to an earlier point.

For an introductory course, think of it as a controlled checkpoint.

Before a lab:

known-good state → snapshot/checkpoint → authorized activity → evidence capture → reset or preserve

A snapshot is useful because experiments change systems.

But snapshots also create responsibility. If students do not know which state they are using, two people can run the same lab and get different results.

Draw the virtualization boundary

Create a diagram with:

• host
• virtualization layer
• guest VM
• guest filesystem
• virtual network interface
• approved evidence folder
• any shared resource

Use arrows to show which connections are allowed.

Then mark each connection as:

• required for the lab
• not required
• unclear, verify before use

The point is to make the invisible boundary visible.

Network modes as risk choices

You do not need to memorize every virtualization product's terminology, but you should understand the general idea that a VM can be given different kinds of network connectivity.

A classroom VM might be:

• disconnected from networking
• connected only to a private lab network
• allowed outbound access through a controlled configuration
• connected more directly to the surrounding network

Those choices change the risk.

A malware-analysis exercise that needs no networking should not receive wider network access just because it is convenient.

Use the minimum connectivity required for the learning objective.

Scenario analysis

Evaluate these fictional lab designs.

Design A

The VM contains a teacher-provided Linux terminal exercise. Networking is disabled.

Design B

Two course VMs communicate on a private classroom network. The exercise requires them to exchange synthetic traffic.

Design C

A VM used for suspicious-file analysis can browse the public internet and has a shared writable folder connected to the host.

For each design:

1. What is the learning objective likely to require?
2. Which connections are necessary?
3. Which connections create extra risk?
4. What would you change before the lab begins?

Virtualization and evidence

Suppose a VM is reset after a lab.

What happens to the evidence stored only inside the guest?

It may disappear.

A good lab workflow decides before the reset which evidence must be exported or preserved.

Examples:

• screenshot
• command transcript
• teacher-approved log copy
• configuration record
• short analysis report

Never export suspicious binaries, real credentials, or unnecessary sensitive data just because the VM is about to reset.

Evidence for Lesson 1

Submit:

• virtualization boundary diagram
• analysis of Designs A, B, and C
• a five-step lab lifecycle from known-good state through evidence preservation

Finish with:

A VM reduces risk only when ________.

Virtualization gives you a controllable environment. Security comes from understanding and enforcing the boundary, not from assuming the word "virtual" means harmless.