None Computing title Omnissa Horizon Client Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-287317 Rule_ID SV-287317r1289637_rule Severity medium Rule_Title The Horizon Client must not connect to servers without fully verifying the server certificate. Vuln_Discuss The Horizon Client connects to the Connection Server, UAG, or other gateway via a Transport Layer Security (TLS) connection. This initial connection must be trusted; otherwise, the sensitive information flowing over the tunnel could potentially be open to interception. The Horizon Client can be configured to ignore any certificate validation errors, warn, or fail. By default, the Client will warn and let the user decide whether to proceed or not. This decision must not be left to the end user. In a properly configured, enterprise environment, there must be no issues with the presented certificate. Allowing the end user to click through any errors allows a TLS connection to be intercepted and subjected to a man-in-the-middle attack. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Certificate verification mode". If "Certificate verification mode" is set to "Not Configured" or "Disabled", this is a finding. If the drop-down menu for "Certificate verification mode" is not set to "Full Security", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Certificate verification mode". Verify "Certificate verification mode" is set to "Enabled". In the drop-down menu below "Certificate verification mode", select "Full Security". Click "OK". Not_Reviewed Vuln_Num V-287318 Rule_ID SV-287318r1294248_rule Severity medium Rule_Title The Horizon Client must not display the option to log in as the current user. Vuln_Discuss Horizon Connection Server can allow clients to authenticate using the local session credentials of their local endpoint. While convenient, this must be disabled for DoW deployments as the server cannot ascertain the method of endpoint login, whether that user's client certificate has since been revoked, and other reasons. This option is disabled in the Horizon Connection Server STIG and must also be disabled on the client. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Display option to Log in as current user". If "Display option to log in as current user" is not set to "Disabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Display option to log in as current user". Verify "Display option to log in as current user" is set to "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287319 Rule_ID SV-287319r1290641_rule Severity high Rule_Title The Horizon Client must be installed in FIPS mode. Vuln_Discuss Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation. The Horizon Connection Server, Agent, and Client must all be configured to exclusively use FIPS 140-3-validated cryptographic modules but only at installation time, not post deployment. Satisfies: SRG-APP-000439, SRG-APP-000014, SRG-APP-000015, SRG-APP-000156, SRG-APP-000157, SRG-APP-000179, SRG-APP-000183, SRG-APP-000219, SRG-APP-000224, SRG-APP-000231, SRG-APP-000440, SRG-APP-000514, SRG-APP-000555, SRG-APP-000560, SRG-APP-000565, SRG-APP-000585, SRG-APP-000600, SRG-APP-000610, SRG-APP-000630, SRG-APP-000635, SRG-APP-000645 Check_Content On the machine where the Horizon Client is installed, launch the Registry Editor. Traverse the registry tree to "HKLM\Software\Omnissa\Horizon\Client\Security" and locate the "EnableFIPSMode" key. If "EnableFIPSMode" does not exist, or does not have a value of "1", this is a finding. Fix_Text FIPS mode can only be implemented during installation. Reinstall the Horizon Client on the machine and select the option to enable FIPS mode. Note: The Horizon Client can only be installed in FIPS mode if the Windows machine itself is running in FIPS mode. Not_Reviewed Vuln_Num V-287320 Rule_ID SV-287320r1289646_rule Severity medium Rule_Title The Horizon Client must not redirect client printers. Vuln_Discuss Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Client, Agent, and guest operating systems will coordinate to allow printers local to the client to be redirected over the Client connection and made available in the virtual desktop. This configuration must be modified to disallow printer redirection to protect sensitive data from being maliciously, accidentally, or casually printed from the controlled environment. Check_Content Printer redirection can be disabled in a number of ways: 1. The desktop OS. 2. A third-party DLP solution. 3. The "Omnissa Integrated Printing" optional Horizon Agent feature not being selected during install on any VDI image. If any of these methods are already employed, the risk is already addressed and this is not a finding. If printer redirection is not otherwise blocked, the Horizon Client must be configured to block printer redirection. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Omnissa Integrated Printing. If "Do not redirect client printer(s)" is not set to "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Omnissa Integrated Printing. Verify "Do not redirect client printer(s)" is set to "Enabled". Click "OK". Not_Reviewed Vuln_Num V-287321 Rule_ID SV-287321r1289649_rule Severity medium Rule_Title The Horizon Client must not allow command line credentials. Vuln_Discuss The Horizon Client supports a variety of command line parameters, including options related to user authentication. In certain deployment scenarios, administrators or users may create scripts or shortcuts that invoke the Horizon Client with authentication-related parameters. If sensitive authentication information such as a smart card PIN, password, or other authenticator, is embedded within these scripts, command lines, batch files, or configuration files, the information may be stored in clear text on the local system. Storage of authenticators in plain text exposes them to unauthorized disclosure through file access, system backups, log files, process inspection, or other means available to malicious users or malware. Compromise of these authenticators could enable unauthorized access to enterprise resources and undermine the effectiveness of multifactor authentication mechanisms. To reduce this risk, organizations must prohibit the hard-coding or storage of credentials, smart card PINs, passwords, tokens, or other sensitive authentication information in scripts, shortcuts, configuration files, automated login processes, or any other persistent storage location. Authentication information must be entered interactively by the user or protected through approved enterprise credential management solutions in accordance with organizational security policies. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. If "Allow command line credentials" is set to "Not Configured" or "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Allow command line credentials". Verify "Allow command line credentials" is set to "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287322 Rule_ID SV-287322r1289652_rule Severity medium Rule_Title The Horizon Client must not connect local USB devices to the remote desktop on launch. Vuln_Discuss Unauthorized USB device access presents a significant security risk by providing a means to introduce malicious code, bypass network security controls, transfer data outside of approved channels, or remove sensitive information from the environment. These risks are not diminished simply because the endpoint is a virtual desktop; virtual desktop environments remain subject to the same data protection and removable media restrictions applicable to physical workstations. Failure to restrict USB pass-through capabilities may result in the loss of confidentiality, integrity, and availability of organizational information and systems. To mitigate these risks, organizations must ensure that USB redirection is disabled or restricted to explicitly authorized device classes in accordance with mission requirements and applicable DoW removable media and data loss prevention policies. Controls available within the Horizon Client and Horizon environment must be used to prevent unauthorized USB devices from being redirected into virtual desktop sessions. Check_Content USB can be blocked in a number of ways: 1. The desktop OS. 2. A third-party DLP solution. 3. The "USB Redirection" optional Horizon Agent feature not being selected during install on any VDI image. 4. On the Connection Server via individual pool policies or global policies. If any of these methods are already employed, the risk is already addressed and this control is not applicable. If USB devices are not otherwise blocked, the Horizon Client must be configured to block USB devices. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. If "Connect USB devices to the desktop or remote application when they are plugged in" is set to "Enabled", this is a finding. If "Connect all USB devices to the desktop or remote application on launch" is set to "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. Verify "Connect all USB devices to the desktop or remote application on launch" is set to either "Not configured" or "Disabled". Verify "Connect USB devices to the desktop or remote application when they are plugged in" is set to either "Not configured" or "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287323 Rule_ID SV-287323r1289655_rule Severity medium Rule_Title The Horizon Client must not store a logon password. Vuln_Discuss The Horizon Client provides an option to save user credentials to facilitate subsequent authentications to a Horizon Connection Server. When this feature is enabled, the user's password is stored locally on the endpoint system. Storage of authentication credentials on the client system increases the risk of credential compromise through unauthorized access to the endpoint, malware infection, registry inspection, backup media exposure, or other forms of system compromise. An attacker who obtains stored credentials may be able to authenticate as the authorized user and gain access to virtual desktop resources, applications, and organizational information. The storage of passwords on endpoint devices is inconsistent with DoW security principles that require protection of authenticators and minimization of credential exposure. To reduce the risk of unauthorized access, the Horizon Client must not be configured to store logon passwords. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. If "Logon Password" is set to "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. Double-click the "Logon Password" setting. Verify "Logon Password" is set to either "Not Configured" or "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287324 Rule_ID SV-287324r1289658_rule Severity medium Rule_Title The Horizon Client must not store a log on username. Vuln_Discuss The Horizon Client allows for storing a username and password to facilitate authentication with a connection server. This configuration is not acceptable in the DoW and must not be enabled. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. If "Logon UserName" is set to "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions. Double-click the "Logon UserName" setting. Verify "Logon UserName" is set to either "Not Configured" or "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287325 Rule_ID SV-287325r1289661_rule Severity medium Rule_Title The Horizon Client must not send anonymized usage data. Vuln_Discuss The Horizon Client includes functionality to collect anonymized data from the client systems to help improve software and hardware compatibility. Although the data is intended to be anonymized, the transmission of information from DoW systems to external entities may expose details about the client environment, software versions, hardware characteristics, usage patterns, or system configurations. The aggregation and correlation of seemingly nonsensitive information can provide insight into an organization's infrastructure and operational environment. Such information may be used to support reconnaissance activities, identify potential attack vectors, or reveal details that should not be disclosed outside of authorized channels. DoW policy requires that information collected from organizational systems be limited to that which is necessary to support mission requirements and that unauthorized transmission of system information be prevented. To reduce the risk of information disclosure and maintain control over organizational data, the Horizon Client must not be configured to collect or transmit anonymized usage, telemetry, or diagnostic data to external parties unless specifically authorized by the organization. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration. If "Allow data sharing" is set to "Enabled" or "Not Configured", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration. Double-click the "Allow data sharing" setting. Verify "Allow data sharing" is set to "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287326 Rule_ID SV-287326r1289664_rule Severity medium Rule_Title The Horizon Client must check certificate revocation status. Vuln_Discuss Preventing the disclosure of transmitted information requires that the device or machine take measures to employ cryptographic mechanism to protect the information during transmission. This is usually achieved using Transport Layer Security (TLS). The Horizon Client connects to the Connection Server, UAG, or other gateway via a TLS connection. This initial connection must be trusted, otherwise the sensitive information flowing over the tunnel could potentially be open to interception. The Horizon Client can be configured to not check certificate revocation status. This must not be allowed and must be validated and maintained over time. Check_Content Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Do not check certificate revocation status". If "Do not check certificate revocation status" is set to "Enabled", this is a finding. Fix_Text Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Do not check certificate revocation status". Verify "Do not check certificate revocation status" is set to either "Not configured" or "Disabled". Click "OK". Not_Reviewed Vuln_Num V-287327 Rule_ID SV-287327r1289667_rule Severity medium Rule_Title The Horizon Client must use a High Assurance Commercial Solution for Classified (CSfC) elliptic curve group for remote access to a classified network. Vuln_Discuss Use of improperly configured or lower-assurance equipment and solutions could compromise high-value information. The National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. The Horizon Client must be configured to use CSfC-compliant algorithms, key sizes, and curves. Check_Content Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. If "Configures SSL protocols and cryptographic algorithms" is not set to "Enabled", this is a finding. Double-click "Configures SSL protocols and cryptographic algorithms". If the checkbox next to "Enable TLS v1.1 and TLS v1.2" is not checked, this is a finding. If "Configures Supported Groups Extension" is not set to "P-384", this is a finding. Fix_Text Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Configures SSL protocols and cryptographic algorithms". Verify the checkbox next to "Enable TLS v1.1 and TLS v1.2" is checked. Set "Configures Supported Groups Extension" to "P-384". Click "OK". Not_Reviewed Vuln_Num V-287328 Rule_ID SV-287328r1289670_rule Severity medium Rule_Title The Horizon Client must use a High Assurance Commercial Solution for Classified (CSfC) cryptographic signature algorithm for remote access to a classified network. Vuln_Discuss Use of improperly configured or lower-assurance equipment and solutions could compromise high-value information. The National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. The Horizon Client can be configured to use CSfC-compliant algorithms, key sizes, and curves. Check_Content Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. If "Configures SSL protocols and cryptographic algorithms" is not set to "Enabled", this is a finding. Double-click "Configures SSL protocols and cryptographic algorithms". If the checkbox next to "Enable TLS v1.1 and TLS v1.2" is not checked, this is a finding. If "Configures Signature Algorithms Extension" is not set to "RSA+SHA384", this is a finding. Fix_Text Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Configures SSL protocols and cryptographic algorithms". Verify the checkbox next to "Enable TLS v1.1 and TLS v1.2" is checked. Set "Configures Signature Algorithms Extension" to "RSA+SHA384". Click "OK". Not_Reviewed Vuln_Num V-287329 Rule_ID SV-287329r1289673_rule Severity medium Rule_Title The Horizon Client must use a High Assurance Commercial Solution for Classified (CSfC) cryptographic algorithm for remote access to a classified network. Vuln_Discuss Use of improperly configured or lower-assurance equipment and solutions could compromise high-value information. The National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. The Horizon Client can be configured to use CSfC-compliant algorithms, key sizes, and curves. Check_Content Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. If "Configures SSL protocols and cryptographic algorithms" is not set to "Enabled", this is a finding. Double-click "Configures SSL protocols and cryptographic algorithms". If the checkbox next to "Enable TLS v1.1 and TLS v1.2" is not checked, this is a finding. If "Configures SSL protocols and cipher suites for TLS v1.1 and TLS v1.2" is not set to "TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384", this is a finding. Fix_Text Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable. Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Configures SSL protocols and cryptographic algorithms". Verify the checkbox next to "Enable TLS v1.1 and TLS v1.2" is checked. Set "Configures SSL protocols and cipher suites for TLS v1.1 and TLS v1.2" to "TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384". Click "OK". Not_Reviewed Vuln_Num V-287330 Rule_ID SV-287330r1289676_rule Severity high Rule_Title The Horizon Client must be a version supported by Omnissa. Vuln_Discuss Unsupported software and systems should not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilities. Software and systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation. When maintenance updates and patches are no longer available, software is no longer considered supported and should be upgraded or decommissioned. Check_Content On the machine where the Horizon Client is installed, launch the Registry Editor. Traverse the registry tree to "HKLM\Software\Omnissa\Horizon\Client" and locate the "Version" key. If the value of "Version" is not a supported version, this is a finding. Fix_Text On the machine where the Horizon Client is installed, remove the outdated client and install the latest version. Not_Reviewed