Moving desktops and applications into VDI and DaaS changes where computing happens, but it does not eliminate the security challenges associated with accessing corporate resources.
Users still connect from a physical device and authenticate before establishing a session with applications and data hosted elsewhere. Zero Trust recognizes that access should not be trusted simply because the user is inside the corporate network or working from company-owned hardware. Instead, security policies consider who or what is requesting access, the device and location from which the request originates, and the resource they are trying to reach.
For virtual workspaces, that means looking beyond the virtual desktop itself.
Trust Starts Before the VDI Session
Identity is an obvious place to begin. A password alone provides limited assurance when credentials can be stolen or compromised. Adding another form of verification, whether through multifactor authentication, a passwordless authentication, a certificate, or a biometric, makes credentials alone less useful to an attacker.
But proving someone’s identity should not automatically give them access to everything behind the login screen.
An employee connecting to a published application has different requirements from an administrator managing infrastructure. A contractor may only need one desktop or application for a limited period. Least-privilege policies can keep access focused on what each user needs.
VDI and DaaS do not eliminate the endpoint, either. The device is still where users authenticate, launch sessions, and view corporate information. If it has been compromised, there may still be opportunities to capture credentials or interfere with an authorized session.
For users who depend primarily on remotely delivered applications, organizations can reconsider how much flexibility those endpoints really need. Purpose-built thin client operating systems can reduce the amount of local software and data security teams must account for. An immutable or non-persistent model can go further by controlling what is allowed to change and what survives a reboot.
Technologies such as secure boot and cryptographically signed operating system components can also validate the environment as it loads. This gives IT greater control over the endpoint’s state and greater confidence that the device is running what it is supposed to run.
Access Is More Than Authentication
Once a user has authenticated, Zero Trust principles continue to apply. Instead of granting broad access to the corporate network, organizations can narrow access to the needs of teh user.
In a VDI or DaaS environment, this can include:
- Limiting access to specific resources. Users can be restricted to the desktops, applications, workloads, and data required for their role.
- Segmenting the environment. Separating resources can make it harder for a compromised account or session to become a path into other parts of the network.
- Controlling the session. Policies around clipboard access, USB redirection, printing, file transfers, and local storage can determine what can move between the endpoint and the remote environment.
These policies do not need to look the same for everyone. A managed corporate endpoint may warrant different permissions than an unmanaged device, while privileged administrators may require tighter controls than standard users. The goal is to make those decisions based on the session’s circumstances rather than treating every authenticated user the same.
Those circumstances can also change. A device may fall out of compliance during the day, or an account may begin behaving in a way that raises concern. Access that made sense when the user first signed in may not make sense several hours later. Re-evaluating that access keeps the initial login from becoming a permanent stamp of approval.
Building Zero Trust from the Endpoint In
There is no single Zero Trust switch for VDI or DaaS. Security depends on decisions made throughout the user’s connection, beginning with identity, location and the endpoint and continuing through the resources and session that follow.
10ZiG’s Zero Trust approach focuses on the endpoint’s role in that larger model. Purpose-built Thin and Zero Client hardware, operating systems, repurposing options, and centralized endpoint management give organizations ways to control the devices being used to reach VDI, DaaS, SaaS, and web application environments.
Zero Trust ultimately reduces assumptions. In VDI and DaaS environments, that principle should apply from the device in the user’s hands to the applications and data behind the virtual desktop.
Are you interested in learning more about where the endpoint fits into your Zero Trust strategy? Request a free demo to discuss your VDI or DaaS environment and how a purpose-built endpoint approach could support your security goals.