7.0

Table Of Contents
Planning for Security Features 5
View offers strong network security to protect sensitive corporate data. For added security, you can
integrate View with certain third-party user-authentication solutions, use a security server, and implement
the restricted entitlements feature.
IMPORTANT With Horizon 6 version 6.2 and later releases, View can perform cryptographic operations using
FIPS (Federal Information Processing Standard) 140-2 compliant algorithms. You can enable the use of these
algorithms by installing View in FIPS mode. Not all View features are supported in FIPS mode. For more
information, see the View Installation document.
This chapter includes the following topics:
n
“Understanding Client Connections,” on page 79
n
“Choosing a User Authentication Method,” on page 82
n
“Restricting Remote Desktop Access,” on page 84
n
“Using Group Policy Settings to Secure Remote Desktops and Applications,” on page 85
n
“Using Smart Policies,” on page 86
n
“Implementing Best Practices to Secure Client Systems,” on page 86
n
“Assigning Administrator Roles,” on page 86
n
“Preparing to Use a Security Server,” on page 87
n
“Understanding View Communications Protocols,” on page 92
Understanding Client Connections
Horizon Client and View Administrator communicate with a View Connection Server host over secure
HTTPS connections. Information about the server certificate on View Connection Server is communicated to
the client as part of the SSL handshake between client and server.
The initial Horizon Client connection, which is used for user authentication and remote desktop and
application selection, is created when a user opens Horizon Client and provides a fully qualified domain
name for the View Connection Server, security server, or Access Point host. The View Administrator
connection is created when an administrator types the View Administrator URL into a Web browser.
A default SSL server certificate is generated during View Connection Server installation. By default, SSL
clients are presented with this certificate when they visit a secure page such as View Administrator.
You can use the default certificate for testing, but you should replace it with your own certificate as soon as
possible. The default certificate is not signed by a commercial Certificate Authority (CA). Use of noncertified
certificates can allow untrusted parties to intercept traffic by masquerading as your server.
VMware, Inc.
79