Rule ID
SV-287319r1290641_rule
Version
V1R1
Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation. The Horizon Connection Server, Agent, and Client must all be configured to exclusively use FIPS 140-3-validated cryptographic modules but only at installation time, not post deployment. Satisfies: SRG-APP-000439, SRG-APP-000014, SRG-APP-000015, SRG-APP-000156, SRG-APP-000157, SRG-APP-000179, SRG-APP-000183, SRG-APP-000219, SRG-APP-000224, SRG-APP-000231, SRG-APP-000440, SRG-APP-000514, SRG-APP-000555, SRG-APP-000560, SRG-APP-000565, SRG-APP-000585, SRG-APP-000600, SRG-APP-000610, SRG-APP-000630, SRG-APP-000635, SRG-APP-000645
On the machine where the Horizon Client is installed, launch the Registry Editor. Traverse the registry tree to "HKLM\Software\Omnissa\Horizon\Client\Security" and locate the "EnableFIPSMode" key. If "EnableFIPSMode" does not exist, or does not have a value of "1", this is a finding.
FIPS mode can only be implemented during installation. Reinstall the Horizon Client on the machine and select the option to enable FIPS mode. Note: The Horizon Client can only be installed in FIPS mode if the Windows machine itself is running in FIPS mode.