V-286751

Discussion

The Horizon Connection Server provides access to virtual desktops and applications that may remain available to users for extended periods of time. Authentication credentials and session tokens retained beyond an appropriate period of inactivity increase the risk that an unauthorized user could gain access to organizational resources by exploiting a stale or unattended session. If cached authentication information remains valid indefinitely, users may be able to reconnect to desktops and applications without reestablishing their identity. This increases the likelihood of unauthorized access resulting from unattended workstations, compromised endpoints, shared devices, or session hijacking. Long-lived authentication artifacts also reduce assurance that the individual accessing the resource is the same individual who originally authenticated. To limit this risk, authentication information maintained by the Horizon Connection Server must be invalidated after 120 minutes. Once the 120-minute period has elapsed, users must reauthenticate before establishing a new desktop connection. Requiring periodic reauthentication helps maintain positive user identification, reduces the exposure associated with stale credentials, and preserves accountability for access to organizational resources.

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Global Settings.

3. In the right pane, click the "General Settings" tab and locate "Disconnect Applications and Discard SSO Credentials for Idle Users" under "Single Sign-On (SSO) Settings".

If the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting is set to "Never", or the value of "Disconnect Applications and Discard SSO Credentials for Idle Users" is set to anything greater than "120" minutes (two hours), this is a finding.