Data security and the virtualised desktop

22 Nov 2011

Companies looking to secure virtualised desktop environments should be working towards a blende approach that offers maximum flexibility, says Matthew Evans, senior systems consultant in the desktop virtualisation group at Quest Software.

With the corporate desktop increasingly looking like the next big target for virtualisation at many companies, we need to consider the impact of different data security options.

Currently, I see them exploring a number of options for virtualising desktops: Microsoft’s Remote Desktop (RD) Session Host; Virtual Desktop Integration (VDI); and Local VDI. Each of these has its own pros and cons, in data security terms.

Some years ago, we used operating systems that offered a choice of either standalone or workgroup editions. While these choices still exist today in current operating systems (OSs), most IT leaders would assume that being part of a networked workgroup was vital to most employees.

While ‘pre-networked’ operating systems delivered the best part of requirements, they also allowed individual users to control and configure their own desktop OS. Essentially, we could all be administrators, if we wanted.

Things are very different now. If we fast-forward through several OS releases, we now have Active Directory, UAC (User Account Control) and local groups such as ‘admins’ and ‘power users’.

Some people argue that moving everything off the desktop and into the data centre gives the IT department greater control of the OS, data and security environment. But what if certain users want to retain more control over their own OS? And is it really an option with Local VDI or are we simply moving data from an endpoint device to a virtual machine (VM)?

If you are empowering users with Local VID, this gives them an offline option, which means that if they are away from the corporate network for several days or even weeks at a time, the risk of data loss is as great as with a traditional company laptop. If the Local VDI image is not synched with the data store and the laptop gets lost, stolen or corrupted, then the data is lost.

However, it could equally be argued that the data is slightly more secure, as whoever steals or finds that laptop would not only need to access the endpoint OS, but also the VM sitting back in the data centre. If the username and password were the same, however, then this might be a moot point.

With any local or offline VDI solution, you need to address ‘worst case scenarios’ and look at solutions that offer options that go beyond just backing up data when a user is in the office.

Hosted desktops, such as RD Session Host and VDI, are advantageous, since the user sessions are not accessed offline. As a result, data doesn’t in theory leave the data centre.

When accessing a hosted desktop, users will use one of several protocols; for example, QuestEOP, HP RGS, Citrix HDX, Teradici PCoIP and so on. These different protocols, and corresponding management tools, offer enhancements to further secure the connection and ensure data security can be obtained.

Speaking generally, rather than about any specific solution, you can re-provision desktops at log off to ensure the virtual desktop is completely refreshed thus not leaving any user data. You can apply application and host restrictions to control access as you, the admin, decides. A couple of the more basic but critical features to look out for are the ability to disable clipboard and local drive redirection and to prevent copy-and-paste functions between endpoint and hosted desktop.

Personally, if I worked for a company that was in the process of deciding on a hosted desktop solution that also met corporate data security requirements, I would look for a product that offered a blended approach and gave me flexibility. One size, after all, does not fit all.