V-286735

Discussion

MFA creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target. Unlike a simple username/password scenario where the attacker could gain access by knowing both the username and password without the user knowing their account was compromised, multifactor authentication adds the requirement that the attacker must have something from the user, such as a token, or to biometrically be the user. MFA is defined as: using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A CAC or PKI Hardware Token meets this definition. A privileged account is defined as an information system account with authorizations of a privileged user. These accounts would be capable of accessing the web management interface. When accessing the application server via a network connection, administrative access to the application server must be PKI Hardware Token enabled. Satisfies: SRG-APP-000149-AS-000102, SRG-APP-000080-AS-000045, SRG-APP-000151-AS-000103, SRG-APP-000153-AS-000104, SRG-APP-000177-AS-000126, SRG-APP-000391-AS-000239, SRG-APP-000392-AS-000240, SRG-APP-000403-AS-000248, SRG-APP-000820-AS-000170, SRG-APP-000825-AS-000180

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Servers.

3. In the right pane, select the "Connection Servers" tab. For each connection server listed, select the server and click "Edit".

4. Click the "Authentication" tab and scroll down to "Horizon Administrator Authentication".

5. Find the currently configured value in the drop-down menu under "Smart card authentication for administrators".

If "Smart card authentication for administrators" is not set to "Required", this is a finding.