HP Anyware Security

HP Anyware incorporates features that maximize the security of any deployment model, including on-premises, hybrid or public cloud architectures:

• RADIUS-based multi-factor authentication (MFA).
• All Anyware components use security certificates to ensure a trusted, end-to-end Transport Layer Security (TLS) connection for TCP communications.
• The PCoIP UDP protocol is encrypted with industry-standard secure AES-256 encryption.
• HP Anyware Connector ensures secure PCoIP traffic flow between external and internal networks.
• The PCoIP protocol is host-rendered and no data ever leaves the remote workstation, except encrypted pixels.

Firewall Settings

The PCoIP protocol uses ports UDP:4172, TCP:4172 and either TCP:443 or TCP:60443 as preferred. These ports must be open to allow the flow of PCoIP traffic through the firewall. For an in-depth look at the port settings for different environments relating to HP Anyware, Management Console and Anyware Zero Clients, see the following KB Article.

Security Certificates

Certificates are used to ensure that all communication endpoints are trusted. All communications between Anyware components are performed over encrypted secure channels that use certificates for validation.

MFA Integrations with Anyware Manager

It is possible to integrate third-party MFA applications with Anyware Manager and HP Anyware. We have tested MFA integrations with certain applications and versions of HP Anyware, within specific environments.

The HP Anyware - Okta MFA Integration in GCP KB article outline the processes involved in setting up these specific integrations.

Disaster Recovery

Business continuity can take many forms. Whether it be a bank processing transactions without interruptions, a retail store transacting sales at point of sale terminals, or universities running computer labs with zero downtime, business continuity is important to every type of organization. Downtime can result in significant losses in revenue or permanent damage to a brand's reputation.

HP Anyware is a perfect option and solution to base your companies and organizations disaster recovery plan around. For detailed information on ow to use HP Anyware as part of your disaster recovery strategy, see Disaster Recovery for Virtual Desktops.

Corporate Security Compliance

Isolating a Secure Content Network

Major media and entertainment corporations rely on the PCoIP protocol to conform with MPAA (Motion Picture Association of America) and CDSA (Content Delivery and Security Association) best practices in addition to meeting Trusted Partner Network (TPN) compliance obligations. Media assets are securely isolated on production networks, only accessible from authorized network endpoints as an AES-256 encrypted stream of pixels. As media assets themselves are never downloaded to the endpoints, intellectual property remains secured, no matter what applications are used, as outlined in the image below.

Accessing the Public Internet from an Isolated Workstation

Users inside highly secured enterprises, such as TPN certified environments or those compliant with MPAA or CDSA best practices, may require the public internet for access to media assets or other information. HP Anyware enables isolated remote workstations, such as those attached to content networks, to access the public internet via back-to-back PCoIP connections as outlined in the image below.

Referring to the diagram above, the secured remote workstation is deployed with both Anyware Agent software and Anyware Client software. While the Anyware Agent software serves encrypted pixels to the user at the Anyware Client, a second Anyware Agent deployed on a generic virtual desktop outside the high security domain serves the remote workstation with the internet browser image of the virtual desktop, also in the form of encrypted pixels. Such an architecture, supported on Windows, macOS, and Linux remote workstations, ensures that the airgap perimeter of the high security domain is only traversed with encrypted pixels which adheres to compliance practices.