V-286764

Discussion

One of the many benefits of VDI is the separation of the end user from the "desktop" they are accessing. This helps mitigate the risks imposed by physical access. In a traditional desktop scenario, and from a security perspective, physical access is equivalent to ownership. USB devices are physical devices that interact at the driver layer with the guest operating system and are inherently problematic. There are numerous risks posed by USB, including the driver stack, data loss prevention, and malicious devices. Client USB devices are not necessary for general purpose VDI desktops and must be disabled broadly and only enabled selectively as necessary. Note: USB mouse, keyboard and smart card devices are abstracted by Horizon and are not affected by these Horizon configurations.

Check Content

Interview the SA. USB devices can be blocked in a number of ways:

1. The desktop OS.
2. A third party DLP solution.
3. Horizon Agent configuration and GPOs.
4. Horizon Connection Server global policies.
5. Horizon Connection Server per-pool policies.

If options 1, 2, or 3 are implemented on all virtual desktops in this system, this control is not applicable. Option 3 is addressed in the Horizon Agent STIG.

Options 4 and 5 overlap. A Global Policy can be defined to deny USB access but this can be overridden by each desktop pool. We will therefore check and fix this at the pool level.

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Inventory >> Desktops.

3. In the right pane, click the name of each pool that does not explicitly require access to USB devices.

4. On the next screen, click the "Policies" tab.

5. Confirm that the "Applied Policy" is set to "Deny" for "USB Access".

If the "Applied Policy" is not set to "Deny" for "USB Access", this is a finding.

6. Click the "Policy Overrides" tab.

7. Highlight each user.

8. If "USB Access" is set to "Allow" for any user, ensure the exception is required and authorized.

If any user has an override configured that is not required or authorized, this is a finding.