Horizon Forensics Select Hold - The Security Use Case for Third-Party Collaborations
Omnissa Horizon Forensics Select Hold is one of the unknown gems of Horizon. This security feature enables organizations to park a used virtual desktop for further inspection. Think of when you return a rental car, and the rental agreement only allows you to drive within a radius. Once you return it, the rental company checks the car for damages, wear, and use. The car navigation system would show them where you went. If you went outside the agreed perimeter they would find out.
Forensics Select Hold enables this same functionality for virtual desktops. It allows the desktop admin, typically IT, to look at the desktop and determine what it was used for, and more importantly, what the user did with it. This can be as simple as logging in and looking at files left behind, checking sites visited and such. It can go very deep with true forensics tools that enable us to see what happened at specific times. OpenText Encase is an example of a solution used in law enforcement for this. Forensics enables organizations to audit collaboration partners that access their networks.
Why is Forensics Select Hold needed and what use cases warrant this tool?
Companies and people collaborate - we see organizations using Horizon for contractors, temporary employees, or seasonal workers who use virtual desktops and connect to internal networks. In the car industry, for example, car manufacturers work together to provide expertise to other car manufacturers, but they also compete.
How does car manufacturer 1 guarantee that the employee from car manufacturer 2 only looks at the data they should look at?
Sure, with assigned rights, a lot of sniffing around can be prevented but data often is stored in places it shouldn’t be. It is better to be safe than sorry, that is why forensics has its place in any organization that collaborates with external people. Trust only goes so far.
How does this Forensics Select Hold work for IT admins?
Certain users or groups will be designated “for inspection.” Once the users end their sessions the virtual machine associated with that session will remain in a “Hold” state. A virtual machine in “Hold” state cannot be deleted, refreshed, or redeployed unless the Forensics administrator role (or a more privileged role) allows it. The Forensics administrator handles inspection and releasing the desktop.
Summary
Forensics Select Hold, available with all Horizon subscriptions, is a unique solution for organizations that collaborate with third-party contractors and even competitors. There is no other VDI (Virtual Desktop Infrastructure) solution out there offering this kind of auditing and control over used desktops.
If you’re a Horizon customer, you may already have access to the feature today and if not, check out Horizon by contacting us at https://www.omnissa.com/contact-us/.