Zero-trust virtual desktop infrastructure authentication
Various examples are disclosed for a zero-trust authentication model for virtual desktop infrastructure (VDI) sessions. Upon user authentication of a VDI session, security posture assessments can be performed that analyze an ongoing or continuous state of the user, client device, or network conditions. Remedial measures or mitigation procedures can be performed to address potential non-compliance of the VDI session.
1 . A system, comprising:
at least one computing device;
program instructions stored in memory and executable in the at least one computing device that, when executed by the at least one computing device, cause the at least one computing device to:
authenticate a virtual desktop infrastructure (VDI) session associated with a user based upon at least one authentication mechanism;
obtain a first security posture of a user account associated with the VDI session;
obtain a second security posture of at least one of a network or a client device from which the user account is connecting to the VDI session;
perform an evaluation of the first security posture and the second security posture;
determine that a mitigation procedure is required based upon identifying a non-compliant state by the evaluation of the first security posture and the second security posture;
identify a mitigation based upon the evaluation; and
perform the mitigation to at least one of the VDI session, the user account, or the client device, wherein the mitigation comprises terminating the VDI session after a timeout period and wherein the timeout period is extended or eliminated in response to the user correcting the non-compliant state identified by the evaluation.
2 . The system of claim 1 , wherein the mitigation comprises performing another user authentication of the user based upon the at least one authentication mechanism.
3 . The system of claim 1 , wherein the evaluation of the first security posture and the second security posture comprises a continuous evaluation of the VDI session after an initial startup of the VDI session.
4 . The system of claim 1 , wherein the mitigation comprises pausing the VDI session until the non-compliant state identified by the evaluation is corrected.
5 . The system of claim 1 , wherein the mitigation comprises generating a notification within the VDI session containing information about the non-compliant state identified by the evaluation.
6 . A non-transitory computer-readable medium embodying program code executable in at least one computing device that, when executed by the at least one computing device, causes the at least one computing device to:
authenticate a virtual desktop infrastructure (VDI) session associated with a user based upon at least one authentication mechanism;
obtain a first security posture of a user account associated with the VDI session;
obtain a second security posture of at least one of a network or a client device from which the user account is connecting to the VDI session;
perform an evaluation of the first security posture and the second security posture;
determine that a mitigation procedure is required based upon identifying a non-compliant state by the evaluation of the first security posture and the second security posture;
identify a mitigation based upon the evaluation; and
perform the mitigation to at least one of the VDI session, the user account, or the client device, wherein the mitigation comprises terminating the VDI session after a timeout period and wherein the timeout period is extended or eliminated in response to the user correcting the non-compliant state identified by the evaluation.
7 . The non-transitory computer-readable medium of claim 6 , wherein the mitigation comprises performing another user authentication of the user based upon the at least one authentication mechanism.
8 . The non-transitory computer-readable medium of claim 6 , wherein the evaluation of the first security posture and the second security posture comprises a continuous evaluation of the VDI session after an initial startup of the VDI session.
9 . The non-transitory computer-readable medium of claim 6 , wherein the mitigation comprises pausing the VDI session until the non-compliant state identified by the evaluation is corrected.
10 . The non-transitory computer-readable medium of claim 6 , wherein the mitigation comprises generating a notification within the VDI session containing information about the non-compliant state identified by the evaluation.
11 . A method, comprising:
authenticating a virtual desktop infrastructure (VDI) session associated with a user based upon at least one authentication mechanism;
obtaining a first security posture of a user account associated with the VDI session;
obtaining a second security posture of at least one of a network or a client device from which the user account is connecting to the VDI session;
performing an evaluation of the first security posture and the second security posture;
determining that a mitigation procedure is required based upon identifying a non-compliant state by the evaluation of the first security posture and the second security posture;
identifying a mitigation based upon the evaluation; and
performing the mitigation to at least one of the VDI session, the user account, or the client device, wherein the mitigation comprises terminating the VDI session after a timeout period and wherein the timeout period is extended or eliminated in response to the user correcting the non-compliant state identified by the evaluation.
12 . The method of claim 11 , wherein the mitigation comprises performing another user authentication of the user based upon the at least one authentication mechanism.
13 . The method of claim 11 , wherein the evaluation of the first security posture and the second security posture comprises a continuous evaluation of the VDI session after an initial startup of the VDI session.
14 . The method of claim 11 , wherein the mitigation comprises pausing the VDI session until a non-compliant state identified by the evaluation is corrected.