Rule ID
SV-286732r1294274_rule
Version
V1R1
Role-based access and least privilege are two fundamental security concepts that must be properly implemented in Horizon Connection Server to ensure the correct users and groups have the appropriate permissions on the relevant objects. Horizon Connection Server allows for assigning roles (predefined sets of permissions) to specific users and groups on a specific Access Group (set of objects). Administrators must ensure that minimal permissions are assigned to the correct entities, in the right scope, and that the permissions remain unchanged over time. Satisfies: SRG-APP-000033-AS-000024, SRG-APP-000118-AS-000078, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082, SRG-APP-000123-AS-000083, SRG-APP-000290-AS-000174, SRG-APP-000315-AS-000094, SRG-APP-000340-AS-000185, SRG-APP-000380-AS-000088
1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Administrators. 3. In the right pane, click the "Administrators and Groups" tab. 4. Review each user and group in the left pane and their associated role in the far right pane. 5. Permissions must be as restrictive as possible and their scope (Access Group) as limited as possible. Verify no user or group has unnecessary permissions and that their Access Group is appropriately limited. Pay special attention to the "Local Administrator" and "Administrator" roles on the root Access Group, as those roles have total control over the local and global environment, respectively. Anyone with any administrative role can log in to the Console and view potentially sensitive configurations, system details, and events. If any user or group has permissions that are more permissive than the minimum necessary, this is a finding.
1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Administrators. 3. To remove users or groups: a. In the right pane, from the "Administrators and Groups" tab, select the unnecessary users or groups in the left pane and click the "Remove" button. b. Click "OK" to confirm removal. 4. To modify assigned permissions: a. In the right pane, from the "Administrators and Groups" tab, select the appropriate user or group in the left pane. b. In the right pane, select the role to remove and click "Remove Permissions". c. Click "OK" to confirm removal.