V-286749

Discussion

The Horizon Connection Server provides remote access to virtual desktops, applications, and organizational resources from endpoints that may be operating outside the direct physical control of the organization. When a client connection is interrupted due to network failure, device mobility, loss of connectivity, or other communication issues, the server can no longer verify that the endpoint remains under the control of the originally authenticated user. If a disconnected session can be resumed without reauthentication, an unauthorized individual who gains access to the endpoint or session context may be able to reconnect and assume the identity of the original user. Such access could permit unauthorized use of organizational resources, compromise accountability, and weaken the assurance that actions performed within the session are attributable to the authenticated user. Requiring reauthentication following a network interruption reestablishes the user's identity before access to the disconnected session is restored. This additional verification helps ensure that the session remains under the control of an authorized user, reduces the risk of session hijacking, and preserves accountability and nonrepudiation for actions performed within the virtual desktop environment. To maintain the security of remote access sessions and protect organizational resources, disconnected Horizon sessions must require user reauthentication before session access is restored.

Check Content

If the HTTPS Secure Tunnel is not enabled, this control is not applicable.

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Global Settings.

3. In the right pane, click the "Security Settings" tab.

If the "Reauthenticate Secure Tunnel Connections After Network Interruption" value is set to "No", this is a finding.