Rule ID
SV-286738r1294276_rule
Version
V1R1
Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation. The Horizon Connection Server can be configured to exclusively use FIPS 140-3 validated cryptographic modules but only at installation time, not post deployment. Reference Omnissa documentation for up-to-date requirements for enabling FIPS in Omnissa Horizon. Satisfies: SRG-APP-000179-AS-000129, SRG-APP-000224-AS-000152, SRG-APP-000416-AS-000140, SRG-APP-000439-AS-000274
1. On the Horizon Connection Server, launch the Registry Editor. 2. Traverse the registry tree to "HKEY_LOCAL_MACHINE\Software\Omnissa\Horizon". 3. Locate the "FipsMode" key. If "FipsMode" does not exist, this is a finding. If "FipsMode" does not have a value of "1", this is a finding.
1. FIPS mode can only be implemented during installation. 2. Redeploy the virtual machine and install the Horizon Connection Server with the FIPS mode option selected. Note: The Connection Server can only be installed in FIPS mode if Windows Server itself is running in FIPS mode. If not installed in FIPS mode initially, the recommendation is to redeploy the virtual machine, enable FIPS mode in Windows, and install the connection server rather than uninstalling and reinstalling the connection server software, as LDAP issues may occur if reinstalling the software with a different FIPS setting.