Trusteer Rapport Virtual Implementation Scenarios

Transcription

1 Trusteer Rapport Virtual Implementation Scenarios Technical White Paper Version 1.0 October 2012 new threats, new thinking

2 Contents About this Document 1 1. Overview of Virtual Desktop/Machine Environments 2 Local Virtual Machine Desktops 2 Hosted Virtual Machines Infrastructure 2 Local Streamed Desktops (OS Streaming) 3 Shared Virtual Desktop Infrastructure (Session Virtualization) 3 Application Streaming 4 2. Best Practices when Implementing Rapport on Virtual Environments 5 Local Virtual Machine Desktops 5 Where to Install Rapport? 5 How is Rapport Affected in this Implementation? 5 Hosted Virtual Machine Infrastructure 5 Where to Install Rapport? 5 How is Rapport Affected in this Implementation? 6 Local Streamed Desktops 6 Where to Install Rapport? 6 How is Rapport Affected in this Implementation? 7 Shared Virtual Desktop Infrastructure (Session Virtualization) 7 Where to Install Rapport? 7 How is Rapport Affected in this Implementation? 8 Application Streaming 8 Trusteer Rapport Virtual Implementation Scenarios ii

3 Where to Install Rapport? 8 3. Supported Operating Systems 9 Trusteer Rapport Virtual Implementation Scenarios iii

4

5 About this Document Described below are the major Virtual Desktop implementation scenarios available in the market. Each one of these scenarios has its advantages and disadvantages. Please follow this document in order to understand how and where to successfully integrate Trusteer Rapport in your virtual infrastructure. Trusteer Rapport Virtual Implementation Scenarios 1

6 1. Overview of Virtual Desktop/Machine Environments Local Virtual Machine Desktops Desktop runs on the user s local device on a virtual machine (VM). This enables a user to run multiple desktops on the same physical computer allowing IT to lockdown the business environment on one desktop while the users can still make personal use of their PC. Some examples of such infrastructures are: Citrix Local VM Desktop (FlexCast) VMware workstation Microsoft Hyper-V Hosted Virtual Machines Infrastructure A central machine consisting of multiple Virtual Machines serving users who may be geographically scattered but are all connected to an assigned isolated VM by a proprietary protocol using a client interface delivered by one of the vendors providing the Virtualization platform. Some examples of vendors who provide this technology are: Citrix XenDesktop Hosted VDI Desktop Flexcast VMware View Microsoft Desktop Virtualization Sun VirtualBox Hosted Desktop virtualization provides the advantage in which every computer operates as a completely self-contained, isolated unit with its own operating system, peripherals and application programs. Trusteer Rapport Virtual Implementation Scenarios 2

7 Local Streamed Desktops (OS Streaming) With OS streaming, computers boot and run from using image file stored on the network, in a fashion similar to audio streaming. With audio streaming, songs are maintained on a central server and then streamed to a client PC on demand; with OS streaming, the actual operating system and the applications are streamed to the desktop from a central server when the PC is booted up from a disk image file and when any applications or libraries are loaded. Some examples of vendors who provide this technology are: Citrix Xendesktop Streamed VHD Desktop Flexcast VMware Ace OS streaming provides the advantage of, centralized management of images and patching while letting each user work in an isolated system. Shared Virtual Desktop Infrastructure (Session Virtualization) With Shared desktops (often referred to as remote desktops or session virtualization) a single system runs in the Data center and is shared across multiple users. The remote desktop system cannot be modified by end users and no data is stored locally. Some Vendor examples for Hosted shared Virtual Desktops are: Citrix XenDesktop XenApp (session virtualization) Microsoft Remote Desktop (RDP) Real VNC Enterprise Shared Virtual Desktops ensure, confidential data is secured and supports a large number of users on the same machine. Trusteer Rapport Virtual Implementation Scenarios 3

8 Application Streaming With Application streaming, users run each on their own PC while the applications are streamed to the client PC upon demand. IT administrators can manage apps and let users choose the application they need to use according to their permissions. This allows offline use of the OS and full isolation between different users. Citrix On Demand Apps VMware Thinapp Microsoft App-V Trusteer Rapport Virtual Implementation Scenarios 4

9 2. Best Practices when Implementing Rapport on Virtual Environments There are a few issues to consider when implementing Trusteer Rapport on virtual environments. These considerations are based on the type of access, the type of implementation and the need of Rapport coverage. Local Virtual Machine Desktops Where to Install Rapport? When an application streaming infrastructure is used, Rapport is not able to function properly. In cases like these Trusteer recommends creating a separate virtual installation using any of the Supported Operating Systems (on page 9). This Virtual Machine should be available to individuals who require secure online banking and shall be used for this purpose. This setup ensures full Rapport functionality while not impacting other user s daily work. How is Rapport Affected in this Implementation? Using this implementation scenario and as long as Rapport is installed on one of the supported OS platforms listed at the bottom of this document. There are no limitations which should prevent Rapport normal functionality. Hosted Virtual Machine Infrastructure Where to Install Rapport? In Hosted VDIs Trusteer Rapport should be installed on the virtual images hosted on the central server. Depending on the permissions set by the Administrator, the end users may or may not have permissions to install/un-install software on the different images including Rapport. Trusteer Rapport Virtual Implementation Scenarios 5

10 With Hosted Virtual Machine Infrastructures each single user gets a remote virtual machine assigned to them upon access. This machine does not necessarily have to be the exact same physical machine every time the user connects. The Hosted Virtual machines are isolated from each other and changes made by one user affects that specific user only. Hosted Virtual environments can consist of multiple different OS versions where each user is directed to the relevant platform running the specific relevant OS. How is Rapport Affected in this Implementation? In specific cases where a malware removal process is initiated, Rapport requires a reboot of the system in order to complete the malware removal. Permissions to reboot remotely hosted virtual desktops are required. Trusteer recommends enabling these permission levels in order to keep Rapport up to date and ensure full protection. Local Streamed Desktops Where to Install Rapport? In Local streamed VDIs Trusteer Rapport should be installed on the image that is streamed to the end user PC. In some cases, the OS streamed to the end users PC is refreshed and served clean on each reboot of the end user s PC however in other configurations the end users data will be saved on a vdisk and this data is served to the users on the next time they boot their system. Trusteer Rapport Virtual Implementation Scenarios 6

11 How is Rapport Affected in this Implementation? There are two main implementations for streamed Desktops: 1. Non-persistent implementations In these implementation types the end user receives a new "clean" OS on every boot of their client PC. This means that the OS consists of the same settings as long as the Administrator has not updated the images that are served to the end users. In these cases, Rapport will not be properly updated in terms of configuration and software updates. It is strongly advised not to use this implementation type for Rapport installations. 2. Persistent implementations - In these types of implementations, supported by some virtualization vendors, where changes are stored and saved per user on a remote vdisk. (i.e. Citrix XenDesktop Streamed VHD Private mode), Rapport stays up to date as configuration and updates are stored per user. Note: While technically possible, Trusteer strongly advises against running Rapport in an environment which serves a clean OS on every boot. This will most certainly lead to updates and configurations being erased, resulting in outdated Rapport versions and configurations and in rapidly degrading protections over time. In such Infrastructures Trusteer advises to provide a specific virtual installation on a local machine for the entities which may require secure online banking. Shared Virtual Desktop Infrastructure (Session Virtualization) Where to Install Rapport? In case of a remote server handling multiple user sessions, Rapport is installed on that specific server or, when there are multiple load balanced remote servers, Rapport needs to be installed on each of these servers. Rapport Version has multiple session support and therefore a single installation of Rapport can handle multiple profiles. Trusteer Rapport Virtual Implementation Scenarios 7

12 How is Rapport Affected in this Implementation? As Rapport is installed only once, enabling or disabling it performs the task for all users/sessions currently using the remote server. Note: When only a few individuals in the company require secure online banking access with Rapport, it is recommended to install a virtual machine on the remote server. Only these specific individuals should have access to the VM image running Rapport. This ensures full Rapport functionality without impacting other user s system functionality. Running Trusteer Rapport on Windows Servers Trusteer Rapport is supported on the following servers: Win 2K3R2, 32 and 64 bit, Win 2K8R1, 32 and 64 bit Win 2K8R2, 64 bit. The server version of Rapport enables the Administrator to decide if Rapport sends users restart requests when required or if the restart requests are presented to the end users in order to avoid a situation where one user restarts the system for all users running on the system. In situations where the restart messages to end users are disabled, the Administrator should follow up on the system alerts and restart the system whenever necessary. Application Streaming Where to Install Rapport? When an application streaming infrastructure is used, Rapport is not able to function properly. In cases like these Trusteer recommends creating a separate virtual installation using any of the Supported Operating Systems (on page 9). This Virtual Machine should be available to individuals who require secure online banking and shall be used for this purpose. This setup ensures full Rapport functionality while not impacting other user s daily work. Trusteer Rapport Virtual Implementation Scenarios 8

13 3. Supported Operating Systems Trusteer Rapport runs on the following operating systems: Windows Operating Systems, 32-bit and 64-bit (Windows XP, Vista and Windows 7), Windows Server 2003 and 2008 (supported in Rapport version 1108) Mac OS X Leopard (10.5), Snow Leopard (10.6) and Lion (10.7) Note: When deploying on Windows 2003 R2 through RDP (Scenario 4), all users accessing the machine should have the "Create Global Objects" privilege (SeCreateGlobalObjects) in order for Rapport to function properly. For detailed information about supported platforms refer to: VDI Type Local Virtual Machine Desktops Supported Hosted Virtual Machine Infrastructure Local streamed desktops (OS streaming) * Shared Virtual Desktop Infrastructure ** Application streaming x *** Notes: * Only Rapport installations on streamed infrastructures where the user s data is stored and served upon reboot will function properly. Rapport Installations where the user s data is erased and a clean OS is served on every boot will not function securely in the long run. See detailed explanation. ** When using a shared Virtual Desktop, in order to provide ideal usability to all users, it is recommended to create a Virtual Image on the remote server and run Rapport of that Virtual image when required. See detailed explanation. *** When using application streaming Rapport requires a separate isolated VM installation in order to function properly. Where to Install Rapport? (on page 5) Trusteer Rapport Virtual Implementation Scenarios 9