Rule ID
SV-286739r1291380_rule
Version
V1R1
If communication sessions remain open for extended periods of time, even when unused, there is the potential for an adversary to hijack the session and use it to gain access to the system. Horizon Connection Server administrative sessions can and must be limited in the amount of idle time that will be allowed before an automatic logoff occurs. By default, 30 minutes of idle time is allowed, but this must be changed to 15 minutes or less (but not 0) for systems on a DoW network. This configuration must be verified and maintained over time. Satisfies: SRG-APP-000220-AS-000148, SRG-APP-000295-AS-000263
1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Global Settings. 3. In the right pane, locate "Horizon Console Idle Session Timeout" under "Horizon Console Settings". If the "Horizon Console Idle Session Timeout" value is set to more than "15" or "0", this is a finding.
1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Global Settings. 3. In the right pane, click the "General Settings" tab. 4. Click "Edit". 5. Under "Horizon Console Settings", set the "Horizon Console Idle Session Timeout" value to "15" (or less), but not "0". 6. Click "OK".