V-287322

Discussion

Unauthorized USB device access presents a significant security risk by providing a means to introduce malicious code, bypass network security controls, transfer data outside of approved channels, or remove sensitive information from the environment. These risks are not diminished simply because the endpoint is a virtual desktop; virtual desktop environments remain subject to the same data protection and removable media restrictions applicable to physical workstations. Failure to restrict USB pass-through capabilities may result in the loss of confidentiality, integrity, and availability of organizational information and systems. To mitigate these risks, organizations must ensure that USB redirection is disabled or restricted to explicitly authorized device classes in accordance with mission requirements and applicable DoW removable media and data loss prevention policies. Controls available within the Horizon Client and Horizon environment must be used to prevent unauthorized USB devices from being redirected into virtual desktop sessions.

Check Content

USB can be blocked in a number of ways:

1. The desktop OS.
2. A third-party DLP solution.
3. The "USB Redirection" optional Horizon Agent feature not being selected during install on any VDI image.
4. On the Connection Server via individual pool policies or global policies.

If any of these methods are already employed, the risk is already addressed and this control is not applicable.

If USB devices are not otherwise blocked, the Horizon Client must be configured to block USB devices.

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions.

If "Connect USB devices to the desktop or remote application when they are plugged in" is set to "Enabled", this is a finding.

If "Connect all USB devices to the desktop or remote application on launch" is set to "Enabled", this is a finding.