STIGhubSTIGhub
STIGhub— A free STIG search and compliance tool·STIGs updated 2 hours ago
Powered by Pylon·Privacy·Terms·Feedback·© 2026 Beacon Cloud Solutions, Inc.
← Back to STIGs

Omnissa Horizon Connection Server Security Technical Implementation Guide

Version

V1R1

Release Date

Oct 7, 2026

SCAP Benchmark ID

Omnissa_Horizon_Connection_Server

Total Checks

39

Tags

other
CAT I: 3CAT II: 36CAT III: 0

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (39)

V-286728MEDIUMThe Horizon Connection Server must limit the number of concurrent client sessions.V-286729HIGHThe Horizon Connection Server must use encryption strength in accordance with the categorization of the management data during remote access management sessions.V-286730MEDIUMThe Horizon Connection Server must be configured to only support TLS 1.2 connections.V-286731MEDIUMThe Horizon Connection Server must be configured to use debug level logging.V-286732MEDIUMThe Horizon Connection Server administrators must be limited in terms of quantity, scope, and permissions.V-286733MEDIUMThe Horizon Connection Server user interface must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system.V-286734MEDIUMThe Horizon Connection Server must be configured with an events database.V-286735HIGHThe Horizon Connection Server must use multifactor authentication (MFA) for network access to privileged accounts.V-286736MEDIUMThe Horizon Connection Server must only allow HTTPS connections.V-286737MEDIUMThe Horizon Connection Server must perform full path validation on server-to-server TLS connection certificates.V-286738HIGHThe Horizon Connection Server must only use FIPS 140-3-validated cryptographic modules.V-286739MEDIUMThe Horizon Connection Server must time out idle administrative sessions after 15 minutes or less.V-286740MEDIUMThe Horizon Connection Server must protect log files from unauthorized access.V-286741MEDIUMThe Horizon Connection Server must off-load events to a central log server in real time.V-286742MEDIUMThe Horizon Connection Server must require common access card (CAC) reauthentication after user idle timeouts.V-286743MEDIUMThe Horizon Connection Server must be configured with a DoW-issued TLS certificate.V-286744MEDIUMAll Horizon components must be running supported versions.V-286745MEDIUMThe Blast Secure Gateway must be configured to only support TLS 1.2 connections.V-286746MEDIUMThe Horizon Connection Server must force server cipher preference.V-286747MEDIUMThe Horizon Connection Server HTTPS Secure Tunnel must validate client and administrator certificates in the case of common access card (CAC) authentication.V-286748MEDIUMThe Horizon Connection Server must only trust DoW issuers for Public Key Infrastructure (PKI) logins.V-286749MEDIUMThe Horizon Connection Server HTTPS Secure Tunnel must reauthenticate users after a network interruption.V-286750MEDIUMThe Horizon Connection Server must disconnect users after a maximum of ten hours.V-286751MEDIUMThe Horizon Connection Server must invalidate single sign-on (SSO) Credentials after 120 minutes of idle time.V-286752MEDIUMThe Horizon Connection Server must discard single sign-on (SSO) credentials after 15 minutes.V-286753MEDIUMThe Horizon Connection Server must not allow "Log On As Current User".V-286754MEDIUMThe Horizon Connection Server must require DoW Public Key Infrastructure (PKI) for client logins.V-286755MEDIUMThe Horizon Connection Server must backup its configuration daily.V-286756MEDIUMThe Horizon Connection Server Instant Clone domain account must be configured with limited permissions.V-286757MEDIUMThe Horizon Connection Server must disable client initiated TLS renegotiation.V-286758MEDIUMThe Horizon Connection Server must have X-Frame-Options enabled.V-286759MEDIUMThe Horizon Connection Server must have Origin Checking enabled.V-286760MEDIUMThe Horizon Connection Server must enable the Content Security Policy (CSP).V-286761MEDIUMThe Horizon Connection Server must use default Content Security Policy (CSP) directives.V-286762MEDIUMThe PC over IP (PCoIP) Secure Gateway must be configured with a DoW-issued Transport Layer Security (TLS) certificate.V-286763MEDIUMThe Horizon Connection Server must not allow unauthenticated access.V-286764MEDIUMThe Horizon Connection Server must be configured to restrict USB passthrough access.V-286765MEDIUMThe Horizon Connection Server must prevent Multipurpose Internet Mail Extensions (MIME) type sniffing.V-286766MEDIUMThe Horizon Connection Server must not be enrolled in the Omnissa Customer Experience Improvement Program (CEIP).