Get a DLP system in place for god sakes. I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.
1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.
All the DLPs rely on, effectively, regular expression searches of traffic.
This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work.
If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email.
Hopefully you can spot the non-DLP prevention mechanisms for all of these...
What is it?
https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...
Basically the machine is not allowed to access the internet and USB drives do not work. Only specific locked down applications like the email app, web browser, and so forth have internet access. Downloads are allowed but uploads are not.
A permissions interface is available for say legitimate transfers of data to a flash drive or a web upload, in that case the user will have to add a valid reason and the specific files into the form. Once that's checked and approved by a higher-up the files are temporarily placed in a special folder that permits transfer out. The same thing goes for external emails that aren't on a whitelist, they'll need approval before they get sent.
What VMs are helpful for is cross-contamination and spyware attacks from other clients a contractor is working for.
Sure, they can't do any of that, and development becomes miserable. You don't have to go full VM and remote desktop to prevent those things.