Does making a seperate template for each appvm increase security?

[phceac]

For a related concrete example, I think there were some interesting suggestions for making templates without network infrastructure in an earlier topic:

Disable Internet Access on Vault Even When NetVM is Provided

Hi, The vault is supposed to be a secure, offline qube for sensitive data, and by default, it has no netvm. But if I accidentally or intentionally assign a netvm to it, it can connect to the internet. That doesn’t feel secure enough for a “vault”, it’s just a VM that’s offline until you give it a network. Shouldn’t it refuse internet access even if a netvm is added? Maybe the system could at least warn you when assigning a netvm to vault, like it does for templates. That’s my feature request!…

I believe that removing functionality from inside the template does not guarantee there are no ways for mistakes/compromise to have bad effects, but it can make it much less easy - both for it to happen, and for it to have the worst outcomes. It can be combined with other functions outside the AppVM to enhance protection from some risks.