Rule ID
SV-286833r1289263_rule
Version
V1R1
Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation. The Horizon Connection Server and Agent can both be configured to exclusively use FIPS 140-3-validated cryptographic modules but only at installation time, not post deployment. Reference Horizon documentation for up-to-date requirements for enabling FIPS during the Horizon Agent install. Satisfies: SRG-APP-000439, SRG-APP-000014, SRG-APP-000015, SRG-APP-000156, SRG-APP-000157, SRG-APP-000179, SRG-APP-000183, SRG-APP-000219, SRG-APP-000224, SRG-APP-000231, SRG-APP-000440, SRG-APP-000514, SRG-APP-000555, SRG-APP-000560, SRG-APP-000565, SRG-APP-000585, SRG-APP-000600, SRG-APP-000610, SRG-APP-000630, SRG-APP-000635, SRG-APP-000645
On the template Virtual Machine or on a resultant cloned machine where the Horizon Agent is installed, launch the Registry Editor. Navigate the registry tree to "HKLM\Software\Omnissa\Horizon" and locate the "FipsMode" key. If "FipsMode" does not exist, or does not have a value of "1", this is a finding.
FIPS mode can only be implemented during installation. Reinstall the Horizon Agent on the template Virtual Machine and select the option to enable FIPS mode. Note: The Horizon Agent can only be installed in FIPS mode if the Windows machine itself is running in FIPS mode.