using Amulet Hotkey's PCoIP zero clients for security, access and performance without compromising your desktop or workstation user experience.

Transcription

1 Solutions blueprint High Security Environments ACHIEVE EXCEPTIONAL CLIENT END POINT SECURITY using Amulet Hotkey's PCoIP zero clients for security, access and performance without compromising your desktop or workstation user experience. THE CHALLENGE To deliver essential desktop services related to mission critical or sensitive mandates for government, defense and intelligence organizations that must maximize end-point protection. This has been traditionally achieved with layers of software running on standard desktop, laptop or thin client systems using X86-based processors, creating a number of problems for security, integrity, reliability and maintenance that can put operational readiness at risk. Intelligence data access, real-time analysis multi-level security, and privacy are critical to meet the constant demands of government leaders. However, PCs or laptops with configuration and application data stored locally on end-points are vulnerable to theft and corruption. Also, desktop operating systems require constant patching and maintenance to attempt to keep them secure. Part of the solution is to move the applications and data to a central and secure location and provide users remote access to the desktop or workstation. However, if the client access device is another general purpose X86-based processor it actually increases the potential attack surface and adds to the cost and complexity by the need to secure both the centralized desktop as well as the client endpoint. AT A GLANCE Situation Mandate to deliver essential desktop services securely for Government, defense, intelligence as well as business critical environments. Require flexibility, mobility and reliability while maximizing end-point security. Challenge Eliminate client attack surfaces such as operating system, memory, graphics and storage. Support any desktop experience from basic office users to extreme 3D graphics. Support local users as well as long-distance remote locations. Solution Amulet Hotkey PCoIP Zero clients with extensive security features and design for mission/business critical environments. Connect securely to remote physical or virtual workstations, virtual desktops such as VMware Horizon or managed cloud desktops such as Amazon Web Services Workspaces. These software solutions are more invasive to the computer operating system build process which IT must modify to be able to use the software in a security sensitive environment which is time consuming and complicates upgrades. Also, software based remoting solutions do not offer real-time performance since they take longer to compress application and visualization graphics. End-point clients based on software security increase attack surface and reduce benefit of virtual desktops/workstations

2 Ultra-Secure Virtual Desktop and Remote Workstation with Zero Client Endpoints Amulet Hotkey design and manufacture ultra-secure PCoIP Zero Clients that have been certified by the UK government and NATO to deliver exceptional information assurance security without compromising desktop or workstation performance. Centralizing desktops and workstations within a secure datacenter is an important step to increase security whether using virtual desktops, managed cloud desktops, physical or virtual workstations. A critical next step is to deploy secure PCoIP Zero Clients to avoid the security and manageability challenges of an X86-based client with a Windows or Linux client OS. This helps to significantly reduce the potential attack surface while providing an extensive set of security features. Remove user data from the end-point device When using PCoIP Zero Clients with centralized virtual or physical desktops and workstations only send display pixels to the client endpoint which avoids having applications and user data residing on the end-point device. Applications and sensitive data remain within the secure data center and allow PCoIP zero clients to operate with no local storage. Amulet Hotkey Zero Client Security Benefits for Enterprise and Government Organizations Amulet Hotkey designs and manufactures PCoIP zero clients from the ground up to ensure a robust design and maintain control over quality, reliability and EMI. This includes models where the zero clients and manufacturing has been certified by the UK CESG which is the Cyber Security arm of GCHQ and MI5. These models are listed on the NATO Catalog for use in classified and non-classified environments. All zero client models are fully TAA compliant. Zero clients security-by-design PCoIP zero clients are purpose built clients using Teradici PCoIP processors that decode PCoIP protocol in hardware. As such the zero clients do not have local storage and no sensitive application data is ever processed or stored on the client. Amulet Hotkey zero clients provide an extensive set of security features. PCoIP zero client design eliminates components and functions found in other client devices to eliminate or avoid security risks. Key zero client features: Simple, secure and easy to manage Support for desktop or workstation user experience including demanding 3D graphics Exceptional performance including real-time video and demanding 3D graphics. Support for dual, quad and octal display configurations. PCoIP zero client architecture benefits: No Windows or Linux Application OS No local application execution No local application data storage so no sensitive data ever reaches the client. No hard disk drive Quad & Octal display with dual network connections (copper or fiber) Dual display with copper or fiber network connections No X86-processor No GPU eliminating client display rendering, DirectX, and ActiveX type of exploit risks. No fan for silent operation and improved reliability Dual display with copper or fiber network connections & integrated Smartcard reader Rack mounted, high-density for display walls and up to 48 high-resolution displays Amulet Hotkey PCoIP zero clients are fully compatible with vmware Horizon View Amulet Hotkey Zero Clients bring certified Secure Client Endpoints to Government, Defense and Intelligence organizations and to the security conscious enterprise

3 Key Zero Client Security features Amulet Hotkey zero clients have many security features including: User Authentication PCoIP zero clients support a number of pre-session and post-session user authentication methods. Some options have dependencies on the connection broker and/or middleware. Smart card reader, including models with an integrated Smart Card reader Common Access Card (CAC) and Personal Identity Verification (PIV) smart cards SIPR hardware tokens SafeNet etoken models RSA SecureID Proximity Cards Encryption PCoIP zero clients support a variety of encryption types. Session negotiation security: TLS1.0 with RSA keys and AES128- CBC-SHA or AES-256-CBC-SHA TLS 1.1 with AES128-CBC-SHA or AES- 256-CBC-SHA TLS 1.2 with AES128-CBC-SHA or AES- 256-CBC-SHA NSA Suite B ciphers Session security: PCoIP zero clients encrypt both media stream traffic (display pixel data, USB data and audio data) and management channel traffic Suite-B compliant 192-bit elliptic curve encryption AES-256-GCM AES-128-GCM Salsa Round12 (legacy with Tera1-based zero clients) Zero client models with built-in RJ45 connector or models with SFP slot that support copper or fiber network connections Models with dual network ports for redundancy PCoIP Zero Clients support 802.1x network device authentication IEEE 802.1x network authentication using EAP-TLS certificates SCEP Certificate management IPv6 ready Unique USB lockdown control Unique USB peripheral lockdown capability by being able to block USB plug-events in hardware Flexible control to blacklist or white list USB by device class or specific device IDs Management and Administrative Client On-screen-display menu lockdown options Empty SSL certificate trust store by default. IT can populate trust store with authorized SSL root certificates Zero client reset-to-default control Zero client management interface password protection and enable/disable control Build-to-lossless imaging to ensure users or operators are not analyzing display protocol compression artifacts Optional on-screen message when network connection is lost to alert user or operator that the display information may not be current Ability to disable device event logging. Physical Manufactured by Amulet Hotkey within the UK and all components and materials are sourced ethically from conflict free zones TAA compliant TEMPEST models are available Rugged metal enclosure with advanced EMI-suppression design No moving parts such as HDD or fan which eliminates noise sources and improves reliability Locking power cord to prevent accidental removal Ability to disable zero client buttons for when endpoint is located in a cable tray to prevent accidental operation Low power and passively cooled No noise or vibration Tamper detection (CESG CPA and NATO certified models) Kensington lock slot Amulet Hotkey The only Zero Clients certified as secure by UK CESG and NATO Since the new PCoIP zero clients have no local storage, as soon as a session is disconnected, the client is no longer classified. Employees don t have to worry about locking doors or removing and locking up hard drives. - Jan-Arve Hansen IT Architect NEC CCIS System Support Center (SSC) North Atlantic Treaty Organization (NATO)* Working in partnership with * For full case study of NATO Operations in Northern Europe see

4 Applications 1:1 SECURE REMOTE WORKSTATION Amulet Hotkey zero clients can connect to secure remote workstation hosts such as: CoreStation DXM630 blade workstation Any rack or tower workstation with an Amulet Hotkey remote workstation card (DXP4, DXH4) installed Secure remote access to: Dedicated performance graphics and compute workstations High density graphics and compute virtual workstations Virtual Desktops Cloud Managed Desktops Note: network connections can be across the office, cross-town, cross-country and continent to continent. Command & Control Display Walls 1:N VIRTUAL WORKSTATION OR VIRTUAL DESKTOP Amulet Hotkey zero clients can connect to virtual workstations or virtual desktops such as VMware Horizon vvirtual workstations using Enterprise Graphics Virtualization with nvidia GRID and AMD MxGPU graphics cards. VMware Horizon virtual desktops CLOUD MANAGED DESKTOPS Amulet Hotkey zero clients can connect to cloud managed desktops such as VMware Horizon Air Cloud-Hosted desktops and applications Amazon Web Services Workspaces desktops Advanced High-Resolution Display Walls Amulet Hotkey s unique rack mounted zero clients provide a high-density, reliable and secure solution for advanced display walls for first responder, government and military command and control centers. Avoid Workstation Hard Disk Drive Lockup Certain environments are required to remove and lock up workstation hard drives after each shift. A way to avoid this lockup procedure is to move the workstations into a secure datacenter and users would connect in remotely using an Amulet Hotkey zero client. Browse Down CESG and NATO certified zero client models can be used to Browse Down where a user in a more trusted environment can connect and interact with systems in a less trusted environment. For example, a zero client in a secure network connecting to a virtual desktop or remote workstation at a lower classification level which may have access to the Internet. Browse Across CESG and NATO certified zero client models can be used to Browse Across where a user can connect and interact with systems that may be at the same trust level, but where the networks are segregated. For example, a system administrator access a management terminal within another network, or a user in one department connects to a machine in another department, all at the same level of protective marking.

5 Key Features and Benefits Feature No Windows/Linux client OS Security Benefit No viruses, spyware or patches. No Persistent User data Office buildings can be reduced to a lower security level once users disconnect and leave the premise. Also, there is no local storage to lock up at night. No Application Data sent over the network USB lockdown PCoIP Protocol Adaptive ing PCoIP Protocol Advanced Imaging CESG CPA Certification NATO IAPC Listing IEEE 802.1x Authentication SFP Port IPv6 Ready Empty Certificate Trust Store by Default No application data is sent over the network, also no applications run on the client which avoids application-based exploits. All applications run on the remote workstation or virtual desktop with only an encrypted stream of pixel data sent to the client. Lock down USB to prevent the use of unauthorized peripherals. When un-authorized, the zero client PCoIP processor blocks the USB plug-events in silicon to provide an additional layer of security so that the host desktop/workstation cannot see or access the USB peripheral device. Attempts to use an un-authorized USB device is flagged in the zero client device event log. Flexible control allows IT to blacklist or white list USB by device class or specific device IDs. For example, all USB flash devices can be blocked with the exception of an encrypted flash drive that has been approved for use. There are many adaptive features within the PCoIP remote display protocol to allow users to connect to their workstation or desktop from long distances including cross-continent connections. The PCoIP protocol automatically adapts to the available network to maximize the use experience. Whether connecting from a remote office or a remote operational theater. The PCoIP protocol was designed to support any desktop regardless of the graphics performance of the remote workstation or desktop. The PCoIP protocol supports both software and hardware encoding options in the workstation or virtual desktop which means that the performance is determined by the host system in a secure datacenter. Zero clients simply decode the PCoIP protocol in hardware to maximize the user experience including the most demanding users. UK Government has certified Amulet Hotkey zero clients as secure for use at OFFICIAL level for Government and Public Sector use. The CPA Certification testing includes the design, firmware and manufacturing process compared to the CPA Security Characteristics for Remote Destkop version 1. The DXZC-A certified remote access zero clients are listed on the NATO Information Assurance Product Catalogue. Allows zero clients to be authenticated prior to use. Also ensure that only zero clients with the appropriate security configuration (including the required 802.1x certificates) can operate on the network. Supports copper or fibre network connections for deployment flexibility. Fibre option to further secure endpoints on the network. Ability to take advantage of the larger address space and IPv6 security features. PC s and Internet browsers typically have the certificate trust store pre-populated with a large set of certificates which increases an attack surface if and when certificates are compromised. An empty trust store requires that IT explicitly add the required certificates which increases security and minimizes the attack surface. Rugged metal case and advanced EMI shielded design Reliable operation and EMI shielding to meet secure facility requirements.

6 Ordering Information Certified Zero Clients DXZC-A DXZC-AM DXZC-AC DXZC-AMC DXZ4-A DXZC-AM Displays Max resolution PCoIP decode capability 2 25x x USB ports Integrated Smartcard reader ports interface Standard Dual Display Zero Clients RJ45 SFP RJ45 SFP RJ45 SFP DXZC DXZC-M DXZC-E DXZC-EM DXZC-C DXZC-MC DXZC-EC DXZC-EMC Contact Details EMEA Sales & Support US & Canada Sales & Support APAC Sales & Support London Demo Suite Amulet Hotkey Ltd. 32 Southwark Bridge Road London SE1 9EU England Displays Max resolution PCoIP decode capability USB ports Integrated Smartcard reader ports interface Standard Quad+ Display Zero Clients RJ45 SFP RJ45 SFP RJ45 SFP RJ45 SFP DXZ4 DXZ4-M DXR-Z4* Displays Max resolution PCoIP decode capability 2-25x x x x USB ports ports interface RJ45 SFP SFP Compatible SFP Modules Part# SFP Module Reach SFPF-001G-1 1 Gbps Fibre Up to 500m SFPF-SM1G 1Gbps Single Mode Fibre Up to 10km SFPF-100M 100 Mbps Fibre Up to 2km SFPC-001G 1Gbps Copper Up to 100m SFPC-100M 100 Mbps Copper Up to 100m Note: DXR-Z4 is a zero client card for a DXR-Z rack that holds up to 12 quad monitor zero clients in a 3U 19 rackmount chassis. Zero Clients in Secure Environments v1-us More about PCoIP PCoIP is a ground-breaking technology that compresses and encrypts computer video, USB and audio data using a host device and transmits it over a standard network connection (using AES 256 bit encryption) to a desktop receiver or zero client. The zero client decrypts and decompresses the data stream delivering it to the desktop peripherals. The system is completely secure (CPA accredited versions available on request) and always builds video to a loss-less image making it ideal for the most demanding applications. The zero client creates a secure interface to the computer making it virtually impossible to gain unauthorized access to the remote hardware or data it contains. The zero client stores no data, it cannot be infected by a virus and does not have an operating system to license, maintain, or protect. In addition, all USB devices are managed in hardware at the desktop using black or white lists allowing complete desktop lock-down where appropriate Amulet Hotkey Ltd. All rights reserved. Information in this document is subject to change. No part of this document may be reproduced through any means including (but not limited to) electronic or mechanical, without express written permission from Amulet Hotkey Ltd. Amulet Hotkey Ltd may have patents, patent applications, trademarks or copyrights or other intellectual property rights covering subject matter in this document. PC-over-IP, PCoIP and the PCoIP logo are registered trademarks of Teradici Corp. Amulet Hotkey and solutions you can bank on are registered trademarks of Amulet Hotkey Ltd. Other product names and company names listed within this document may be trademarks of their respective owners. Amulet Hotkey products are designed and built in the UK.