V-287325

Discussion

The Horizon Client includes functionality to collect anonymized data from the client systems to help improve software and hardware compatibility. Although the data is intended to be anonymized, the transmission of information from DoW systems to external entities may expose details about the client environment, software versions, hardware characteristics, usage patterns, or system configurations. The aggregation and correlation of seemingly nonsensitive information can provide insight into an organization's infrastructure and operational environment. Such information may be used to support reconnaissance activities, identify potential attack vectors, or reveal details that should not be disclosed outside of authorized channels. DoW policy requires that information collected from organizational systems be limited to that which is necessary to support mission requirements and that unauthorized transmission of system information be prevented. To reduce the risk of information disclosure and maintain control over organizational data, the Horizon Client must not be configured to collect or transmit anonymized usage, telemetry, or diagnostic data to external parties unless specifically authorized by the organization.

Check Content

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration.

If "Allow data sharing" is set to "Enabled" or "Not Configured", this is a finding.