1. security feature collection
PRODUCT MARKETING
2016/11

2. IGEL PARTITIONS allows to turn pre-installed features on or off
s.a. Citrix Receiver, ThinPrint, etc.
similar to Windows Features

3. UNIVERSAL DESKTOP (LX 10)
Protection against tampering and extended system security during the update process
the update- and boot- mechanism uses a hash value check, whether the partition has been modified
if there is a modified critical partition
the device will not boot
there are two different critical partitions existing on the system
system partition
user partition
if there is a modified uncritical partition
the device will boot, but only the affected part will be deactivated and the scope of function is restricted
apart from the two critical partitions all other partitions are considered as uncritical

4. IGEL PARTITIONS: BENEFITS
firmware customization on customer side
size the firmware down to basic functions
minimize the lines of active code
extend the system performance
flash medium cannot be mounted on any other device
IGEL uses its own partitioning system
IGEL partitions are compressed, thus data is obfuscated
checksums of IGEL partitions avoid loading of modified code
configuration is written to a dedicated and compressed partition
IGEL PARTITIONS: BENEFITS

5. FAIL-SAFE FIRMWARE UPDATE
particularly secure Thin Client management
firmware updates always finish completely
the device always keeps running
the device always stays bootable
update process without critical phases
critical updates always processed by two phases
FAIL-SAFE FIRMWARE UPDATE

6. FAIL-SAFE FIRMWARE UPDATE PROCESS
Start Update
If Update failed
Reboot
Update OK
Reboot
Free Space
UD Firmware 1
Free Space
UD Firmware 2
(Incomplete)
UD Firmware 1
Free Space
UD Firmware 2
(Complete)
UD Firmware 1
Free Space
UD Firmware 2
(Complete)
(UD Firmware 1)
Update starts again
Start new system

7. Define one session type and combine it with an auto logoff command:
user logged out of the last RDP session
the device execute command “logoff” and logs the device
combined with Kerberos, the device is logged and secure
user name and password is required to log-in again
Auto Log-Off

8. pre-installed and ready for use
pure Kerberos-Ticket-Handling, based on
username and password
sophisticated „Two-Factor-Smartcard-Solutions“ (Smartcard and PIN)
through a „three-party-constellation“
IGEL Thin Client
Active Directory infrastructure
Kerberos enabled service (s.a. Citrix XenApp or XenDesktop)
with a sophisticated rules and rights rollout management across the network
on application level
for services
no local „Fake-Active-Directory“
pre-installed and ready for use

9. pre-installed and ready for use
IGEL USB-Management (basic function)
based on USB class, vendor/product-ID or by device UUID
very simplified access and denial mechanism
FabulaTech (extended function, requires optional server components from third party vendor)
based on protocols (RDP, Horizon, Citrix)
features depend on used protocol

10. pre-installed SSO solutions
Smartcard support
individually adaptable IGEL Partitions)
IGEL Smartcard
Gemalto IDPrime
cryptas
SecMaker NetID
A.E.T. SafeSign
SafeNet Aladdin eToken
Smartcard reader support
PC/SC Lite
M.U.S.C.L.E.
HID OMNIKEY
REINER SCT cyberjack
pre-installed SSO solutions

11. pre-installed VPN solutions
OpenVPN
VPN based IGEL client management by IGEL UMS
NCP-e VPN client (optional NCP-e licensing)
universal IPsec-Client
Genua GenuCard support
full management trough the IGEL UMS
connection buildup through the IGEL Thin Client
supports ADSL, LAN, EDGE, 3G and 4G connections
VS-NfD, NATO RESTRICED and RESTREINT UE authorized and certified
pre-installed VPN solutions

12. enables customer to achieve company compliance standards
log the shadowing
distribute different shadowing permissions
define shadowing groups and security levels
ban VNC sessions between client to client (if it´s integrate in to the client desktop)
allow only the IGEL shadowing or a 3rd party VNC client at the UMS console
ban external/unknown 3rd party VNC clients in the whole network
vnc secure mode

13. recycle bin Deleted objects moved there
Restore objects to the original point
Delete objects finally
By mistake deleted objects can be restored

14. WES Security features File Based Write Filter (FBWF)
security standard similar to Linux
the user has the option to deactivate
enables the Windows OS customization
install drivers and applications
Embedded Linux management
manages the WES system in an update or emergency case
manages the device through the embedded Linux, if it boots not correctly
WES Security features

15. High Availability Extension
Two or several UMS-Server within the network
redundancy or scaling
automatic failover mechanism
Integrated Load Balancer
independent simultaneous booting processes
especially developed for larger environments (500+)
can also be used as a redundant system
Supported database-clusters
Oracle DB (11g or higher)
Microsoft SQL Server (2008 or higher)
High Availability Extension