High-Level Security Features of todays Thin Client Generation

Transcription

1 High-Level Security Features of todays Thin Client Generation

2 Thin client computing yields dual benefi ts by decreasing costs and increasing security. Approaches emphasizing Universal Desktops strengthen these effects and permit need-based confi guration of security measures. The topic of data security has fi nally reached top management. According to a survey carried out by solution provider Websense of 1,000 IT administrators, there s a 91 percent participation rate for company management in discussions about data security. Moreover, the survey shows that sensitive data has been stolen from around a third of the companies, including at top executive level. In view of growing threats from the Internet, IT managers see themselves under a great deal of pressure: 72 percent of the IT managers said that protecting sensitive data in the company was more stressful for them than a divorce, debt or a minor car accident. Fundamental Security with a Thin Client Infrastructure The dangers for IT systems described above and the related continuous increase in costs for security measures are quite typical for conventional client/server environments. That is because every single workstation computer, with its numerous interfaces and options for local data storage, represents a potential source of danger. In contrast, such costs and risks do not even begin to occur in server-based computing (SBC) featuring thin clients. With SBC, data backups, storage and restoration of systems and data all take place centrally; with thin clients, there is no need to have locally installed software for these purposes. Even if laptops are used along with thin clients, they too can be confi gured to access the central servers through a LAN or WLAN connection, VPN tunnel and a communications protocol (ICA, RDP or others) and store company-related data solely there instead of locally. In this case as well, only the server has to be protected against theft. Any attack on an end device or even theft of the whole physical unit will not result in a dangerous situation. On the other hand, in client/server networks, it is precisely the end devices that are the weakest links in the security chain since they are usually less secure than the system servers and thus are prime targets for attackers. As we have seen, SBC inherently eliminates this security risk. Less Exposure to Outside Attacks In recent years, there has been a defi nite increase in external attacks. Zero-day attacks are occurring with increasing frequency and require even more rapid response times. A modern countermeasure is intelligent network concepts, such as the Selfdefending Network (SDN) from Cisco. These models use global networking to prevent local attacks from spreading around the world. If a dangerous situation arises, the communications ports for the company network are automatically closed to outside traffi c. Yet such investments are only worth it if there are also no unprotected loopholes within the company network. This is where thin clients offer a secure alternative, for unlike workstation PCs, they have controllable interfaces to the outside, no hard disks or drives where viruses, worm or Trojans could constantly touch down and cause havoc. In server-based computing (SBC) with thin clients, the defense against external attacks can take place solely at the computer center. That means that there are no longer any expenses for antivirus or fi rewall software locally installed at the desktop level. Even internal thefts can be very easily prevented with thin clients. A remote management tool can be used to disable the USB ports on the thin clients for certain types of peripheral devices, either individually or as a group. Depending on the requirements, this measure affects such equipment as memory sticks, CD drives, Bluetooth and WLAN devices and local printers. Internal Data Exchange By its very nature, data exchange in SBC architectures is inherently more secure than in a client/server environment. As a rule with SBC, the data streams between (thin) clients and servers contain only input and output code, such as monitor display data and keyboard entries. Furthermore, these data can be encrypted to prevent hacking of passwords. Moreover, the Microsoft Remote Desktop Protocol (RDP) is always encrypted, whereas this is optional with Citrix Independent Computing Architecture (ICA). In Linux environments, encryption can be done by means of the protocol extension NoMachine NX. Beyond this, there is always the option of establishing virtual private network (VPN) connections between end devices and the computer center. Wireless standalone or mobile thin clients should be connected by means of the Wi-Fi Protected Access standards WPA or WPA2. The management of thin clients should also always be encrypted and certifi cate-based. For example, this is the way the German manufacturer IGEL Technology does it. Its IGEL Universal Management Suite also allows control and management of USB devices. 2/5

3 FIG. 2: PKI-BASED AUTHENTICATION SOLUTION WITH IGEL THIN CLIENTS AND KOBIL MYIDENTITY PKI LOGON ICA USER CERTIFICATE RDP USB TOKENS SERVERS Multifactor Authentication A long-standing and increasing security risk on the user side is the password-based logon process. Fundamentally, the crux of the problem lies in the fact that users who have to remember many passwords or change them at frequent intervals mandated by a company password policy often choose passwords that are easy to guess or even write them down somewhere. In light of this, the most commonly used method of attacking password-based authentication systems is simply guessing passwords. A similar and more involved method is what are known as dictionary attacks, in which hackers run through whole dictionaries in an attempt to fi nd out a password. Passwords can also be determined by using hardware. For example, a key logger installed between the keyboard and the computer records all entries made by the user including, of course, passwords. Another method of infl icting fi nancial losses is fraud through social engineering, of which phishing is a primary example. An effective countermeasure against unauthorized access is multifactor authentication, a solution which in addition to the knowledge factor (something the user knows like a user name, password, PIN), also includes a possession factor (something the user has such as a smartcard or security token) and/or a personal factor (something the user is or does such as a fi n- gerprint, speech or signature). Biometric identifi cation methods such as a fi ngerprint ( personal factor) are considered to be especially secure but are also relatively expensive to implement. A good cost-benefi t ratio can be achieved with smartcard-based solutions ( possession and knowledge factors combined). In this case, the knowledge factor is the PIN number, which also protects the cards against unauthorized use. At the same time, the possession factor is the smartcard hardware itself. Any attempt to read out the PIN is impossible since external attacks inevitably cause the card to be destroyed. Today, in additional to their traditional form, smartcards are also available integrated in USB sticks, a solution with the advantage of not requiring an additional reader (Fig. 2). Right out of the Box: The IGEL Smartcard Solution The German thin client manufacturer IGEL Technology offers its own smartcard solution bundled with its devices, including an (optional) smartcard reader. After successful authentication, an automatic logon process takes place that connects the user with server-based applications, virtual desktops and locally to the software clients and tools integrated in its fi rmware. When the smartcard is removed, the session is interrupted. When the smartcard is inserted into another thin client, the session is continued (session roaming). All IGEL models support externally connected smartcard readers as well as optional internal (onboard) ones. Moreover, all IGEL models work with USB-based authentifi cation solutions. They also allow implementation of roaming and multi-user scenarios. 3/5

4 TABLE 1: SECURITY FEATURES OF UNIVERSAL DESKTOPS (SELECTED EXAMPLES) Category Communications protocols (encryption) VPN Authentication by smartcard Authentifi cation by USB Single Sign-on Host Access IP telephony Virtualization Example Citrix ICA (optional), Microsoft (always), X11R6 (none), NoMachine NX (always), VMware PCoIP (always), Red Hat Spice (optional) Cisco VPN Client (Virtual Private Network), supported by: PPTP (VPN), L2TP IGEL Smartcard Solution (optional), supported by additional smartcard solutions from various providers, including ActivIdentity, AET, Gemalto, Kobil, LOGiCO, NEC, Nexus, S-Trust, SecMaker Aladdin etoken, Kobil myidentity IGEL Smartcard Solution Terminal emulation; Kerberos support for secure host access (Authentifi cation and Single Sign-on) VoIP (SIP Client) by VPN, supported by SRTP (Secure Real Time Protocol) VMware View, Leostream, Citrix XenDesktop, Quest vworkspace, Ericom PowerTerm WebConnect, Red Hat Enterprise Virtualization for Desktops Integrated Security Among the key features of thin client environments is the standardization of the end devices and their central administration. This confi guration cuts energy costs by over 50% and overall costs by up to 70% 1. An additional potential for consolidation is offered by the thin client fi rmware, which contains integrated software tools, clients and protocols that allow direct access to various centralized IT infrastructures. In this way, the thin client can simultaneously become a print server, an IP telephone, a terminal for host applications or an effi cient end device for virtual desktops. In addition, certain fi rmware components ensure secure data exchange. Examples of these are Cisco VPN Client, the VPN protocols PPTP as well as L2TP in Microsoft Windows Embedded Standard, the Secure Realtime Protocol (SRTP) for VoIP conversations or Kerberos, a single sign-on and authentication solution for accessing the host. The greatest benefi ts are offered by manufacturers like IGEL Technology, whose fi rmware enables a uniform security standard to be established for all user scenarios in a company. In this way, for example, home-based workstations can also use fundamental security features available in the thin client environment, such as smartcard-based authentication, single sign-on and encrypted VPN transmission of language and data via DSL. Active Determination of Necessary Measures The infrastructure and management of and the communication within thin client environments together create a high groundfl oor level of security. The centralization of data storage and data security minimizes exposure (decreased target area) to external attackers. The typical savings produced by SBC also mean that IT managers have greater fi nan- cial resources at their disposal to combat growing threats in a proactive and timely manner. Beyond this, the diverse selection of appropriate, combinable security features provides a range of modern solutions that will help to keep current security requirements in line with a vast variety of user scenarios (see Table 1). 1 IGEL thin client with integrated smartcard reader 4/5

5 IGEL S UNIVERSAL DESKTOP CONCEPT a Whether it is server-based computing, virtual desktops or cloud computing IGEL s Universal Desktops work well together with the greatest variety of centralized IT infrastructures. In particular, their powerful hardware and excellent graphics performance, along with continuously developed firmware, provide future-readiness that safeguards this major investment. Thanks to different device designs, operating systems, alternative firmware features (tools, clients and protocols) and a wide range of hardware options, the selection of a suitable model can be tailored to meet the exact needs of the installation and ensure cost efficiency. Other but no less important considerations are that IGEL Universal Desktops use minimal energy, have long service lives and come standard with the IGEL Universal Management Suite, a proprietary remote management solution. FULL SUPPORT OF PERIPHERALS a IGEL Universal Desktops can be integrated into a vast variety of peripheral-device environments. That is because several USB ports, audio inputs/outputs as well as at least one DVI-I interface all come as standard equipment. With an optional Y video cable, all models can even accommodate dualview monitor setups. They also support widescreen formats. Beyond all this, IGEL offers USB serial or parallel adapters, optional mounting bases, integrated smartcard readers and supports external security solutions. The optional bases with their WLAN capability and/or an additional integral serial or parallel port greatly enhance system connectivity. To conserve desktop space, VESA monitor mounting systems are available along with rubber bases allowing horizontal positioning of thin clients for an even smaller device footprint. PCIe Slot mic in line-out Serial Ports USB 2.0 RJ45 Ethernet PS/2 Keyboard Display Port DVI-I Monitor Power Front: 2x USB 2.0. Germany (HQ) IGEL Technology GmbH Hanna-Kunath-Str. 31 D Bremen I Deutschland Phone +49 (0) Fax +49 (0) United Kingdom IGEL Technology Ltd Merlin House I Brunel Road Theale I Reading I Berkshire RG7 4AB I United Kingdom Phone +44 (0) Fax +44 (0) United States IGEL Technology America, LLC 2106 Florence Avenue Cincinnati OH I USA Phone Fax info@igelamerica.com Toll Free (US only): GET IGEL Singapore IGEL Technology Care of: C. Melchers GmbH & Co. Singapore Branch 101 Thomson Road # 24-01/05 United Square Singapore Phone Fax Hong Kong IGEL Technology Care of: Melchers (H.K.) Ltd Shun Tak Centre I West Tower Connaught Road C. Hong Kong I China Phone Fax IGEL is a registered trademark of IGEL Technology GmbH. All hardware and software names are registered trademarks of the respective manufacturers. Errors and omissions excepted. Subject to change without notice. info@igel.com I 04/2012 IGEL Technology 99-EN-2-2