V-287329

Discussion

Use of improperly configured or lower-assurance equipment and solutions could compromise high-value information. The National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. The Horizon Client can be configured to use CSfC-compliant algorithms, key sizes, and curves.

Check Content

Note: If the Horizon Client is not used to access a CSfC Horizon installation, this requirement is not applicable.

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings.

If "Configures SSL protocols and cryptographic algorithms" is not set to "Enabled", this is a finding.

Double-click "Configures SSL protocols and cryptographic algorithms".

If the checkbox next to "Enable TLS v1.1 and TLS v1.2" is not checked, this is a finding.

If "Configures SSL protocols and cipher suites for TLS v1.1 and TLS v1.2" is not set to "TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384", this is a finding.