V-286742

Discussion

When a user session becomes inactive for an extended period, there is no assurance that the originally authenticated user remains present at the workstation or retains control of the session. An unattended or abandoned virtual desktop session may be accessed by unauthorized individuals, resulting in the disclosure, modification, or destruction of sensitive information and organizational resources. If a session that has timed out due to inactivity can be resumed without reauthentication, an unauthorized user may be able to assume control of the existing session and continue operating under the identity of the original user. This undermines accountability, weakens nonrepudiation, and increases the risk of unauthorized access to information systems and data. To mitigate this risk, inactive virtual desktop sessions must be locked when the inactivity timeout period is reached. Access to the locked session must require the user to reauthenticate before resources are made available again. Reauthentication verifies the identity of the user requesting access, helps prevent session hijacking, and ensures that access to organizational resources remains restricted to authorized individuals. Satisfies: SRG-APP-000400-AS-000246, SRG-APP-000389-AS-000253

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Global Settings.

3. In the right pane, click the "General Settings" tab and locate "Enable 2 Factor Reauthentication" under "Client Settings".

If the checkbox next to "Enable 2 Factor Reauthentication" is not checked, this is a finding.