How To Secure Endpoints For VDI & DaaS – Endpoint Security Simplified
One of the key factors driving companies to adopt Virtual Desktop Infrastructures (VDI) or Desktop as a Service (DaaS) is in no doubt security. There are certainly other advantages such as a better user experience, simplified management of user environments, and easier more centralized support, but usually security trumps all of those reasons. We are in an age where users are no longer tied to a local area network and providing a secure and user-friendly way to have access to their work is key. VDI and DaaS technologies have provided a means to simplify this task. However, there is one element that also needs to be addressed in order to achieve similar objectives of securing the environment and reducing the attack surface, all while simplifying management and the end-user experience. That element is endpoints, the devices from which users connect in order to gain access to their virtual workspace. Having a good endpoint strategy is massively important and will keep IT departments away from redundant tasks and focused on the things that matter.
BYOD should be taken with a grain of salt…
It is true that VDI and DaaS allow for access from any operating system. Vendors like Microsoft, Citrix, and VMware have clients for any device one can think of, and users could technically use any device that they want. However, the question is “is this what IT wants to do?” From a security perspective, allowing freedom of choice can mean opening an organization to a very large number of vulnerabilities and attackers will have numerous angles of attack. This brings us to the next point….
Not all Endpoints operating systems provide the same level of security
To this day, the majority of organizations connect to VDI or DaaS using Windows endpoints. Usually, this comes down to habit or convenience as Windows is usually the platform with the most compatibility in terms of drivers and applications. However, one needs to ask “at what cost should Windows be accepted as the platform of choice for accessing virtual workspaces?” Windows is the most attacked operating system and no matter how hardened it is, by placing it on the endpoint, companies need to mitigate the risk with costly security solutions. Beyond security concerns, there are a slew of reasons why such an operating system is costly and requires huge upkeep (i.e. patch management, more areas to support users with, etc..). If users are only using the endpoint to access that virtual workspace then a heavy operating system such as Windows may be overkill. A far better option could be a lightweight, read-only Linux-based operating system running minimal packages and purpose-built for accessing VDI and DaaS. This has been our mission at ZeeTim with the ZeeOS operating system.
Yes, but Linux can be attacked too…
This is true, however a Linux OS can be further hardened. With our ZeeOS, beyond it being read-only, we only allow application packages that are provided by our team. The packages must be deployed securely through the ZeeConf management tool. Packages do not talk to one another and run in separate sandboxes. A user from a device running ZeeOS has no ability to do anything to change the configuration of the device. All configurations must be done through ZeeConf and all communication between the management and the endpoint is SSH encrypted.
Endpoint Security is expensive, Not acting can be even more expensive. The right endpoint OS makes this a non-issue!
A booming area in cyber security is endpoint security. There are many vendors providing solutions to deter attacks and identify a security threat as quickly as possible (sometimes after the damage has occurred). Some of these vendors surpass a billion dollars in yearly revenue. The beauty of an operating system like ZeeOS is that Endpoint threat detection and remediation tools (Antivirus, ERD, XDR) are no longer necessary. The aim is for the endpoint to act as a truly “dumb terminal” that poses no threat to the organization. With such an endpoint, security teams drastically reduce the potential for attack (at the endpoint).
Overall, IT will not only benefit on the security front but management of the endpoints will also be greatly improved.
