We have internal web based apps that require IE 7 and Windows XP due to Active X controls. We've moved to Windows 7 with virtual XP machines. To prevent interne

We have internal web based apps that require IE 7 and Windows XP due to Active X controls. We've moved to Windows 7 with virtual XP machines. To prevent internet access we've stopped any traffic at the firewall with the virtual machines. We think this will work to prevent internet based attacks, but realize we're still vulnerable to physical attacks through media. It was the best we can do given our reliance on the older system. Any other holes in this other than the physical issue?