You can differentiate your company simply by having great cybersecurity. This technical session will arm you with our best practices for ensuring security across the enterprise. Watch the full session on SynergyTV and follow along with the slides here! http://live.citrixsynergy.com/2016/player/ondemandplayer.php?presentation_id=e75d7f25-2d01-4cd5-b77e-945e75905d08

1. 1 © 2016 Citrix

2. 2 © 2016 Citrix

3. 3 © 2016 Citrix
We want to share with you why focusing on security is a great opportunity for your business
and help our customers gain competitive differentiation through security.
and provide technical best practices you can incorporate into security based assessments and
designs.
This a technical session with a lot detailed information like registry entries and PowerShell
commands, which are provided for you in the notes.

4. 4 © 2016 Citrix
2015 was the world’s wake up call..arguably the alarm has been going off since at least 2005
but there’s been more visibility in the last 3 years, due to the snowden effect and an uptick in
attacks.
in the last decade there have been many high visibility breaches such as:
TJMAX | Adobe | Home Depot | Sony | Heartland | Apple | Anthem | Target | OPM | Ashley
Madison
• Billions of dollars are spent on security solutions yet information remains vulnerable
• The volume of data breaches, data loss and theft, and cybercrime has increased
• – and the expectation is that they will only increase over time.
• New threats and attack vectors are emerging every day…whether its social engineering or
ransom ware or denial of service.
• There is no industry sector or vertical that's safe, retail, finance, healthcare, education,
government..all are targets.

5. 5 © 2016 Citrix
We live in a world where the attacks come from anywhere.
The threat actors themselves are a lot more sophisticated and more organized. They
collaborate, they’re unregulated, and profit driven
In here are disgruntled insiders, and hacktivists, sponsored attackers, professional and
amateur hackers, espionage and sophisticated criminal enterprise.
There’s also regulatory pressure.
And there’s disruptive technology like mobile, Cloud, and IoT that continuously test our
capabilities to defend.
These disruptive technologies and trends make our security perimeters more porous.
Data is at rest, in motion, and in use across a complex matrix of endpoints, networks, apps,
and storage and employees are mobile.
You need to prepare for conversations in your accounts that address security across this
matrix.

6. 6 © 2016 Citrix
This is our opportunity
2/3 of organizations say they are increasing their security spend. And in case you are
wondering who to talk to …security decision makers have a rising influence on mobility. 80%
of security leaders have influence over the mobility budget – including 19% (about 1 in 5)
with bottom line authority, and about another 1/3 with significant influence.

7. 7 © 2016 Citrix
When we look at Security, Citrix maps to 5 fundamental pillars that enhance IT and Security
Operations to Reduce Risk
These pillars are identity and access, network, app, and data security with monitoring and
response.
They’re built on a foundation of confidentiality, integrity, and availability.
Each pillar has 3 key components that map directly to our security portfolio
I’m going to hand it over to Martin to dive deeper into recommendations on securing identity
and privilege.

8. 8 © 2016 Citrix
In security, always expect the worst. And always expect that your defenses will be penetrated.
Always ask “And then what?”.
It’s not a question “if” your security will be penetrated, the question is “when”.

9. 9 © 2016 Citrix
January 2006 – Applying the Principle of Least Privilege to User Accounts on Windows XP
• https://technet.microsoft.com/en-us/library/bb456992.aspx
Question is not “if”, but “when” a security attack will happen
• Role of PoLP is to minimize the impact if account is compromised

10. 10 © 2016 Citrix
When talking about least privilege, most people think about delegated administration, but
PoLP should apply to everything – not just administrators, but all user accounts.

11. 11 © 2016 Citrix

12. 12 © 2016 Citrix
While almost everyone understand the reason behind PoLP, very few people realize that it
should be applied to all types of user accounts. Following example is something that we’re
constantly seeing in the field.
Most customers are using groups for publishing (which is great).

13. 13 © 2016 Citrix
But what happens when they need to assign permissions to all users that are using their Citrix
environment? For example add users to local group of Remote Desktop Users and provide
required NTFS permissions for user profiles or folder redirection?

14. 14 © 2016 Citrix
Most of the time they simply use Domain Users or Authenticated Users. This is one of the
examples where people don’t follow PoLP principle and don’t even know it.

15. 15 © 2016 Citrix
Avoid using multiple group to provide access to the environment. If you require membership
in multiple groups, not only you are more prone the error when provisioning access, but also
you can potentially leave unnecessary privileges when you decommission access.

16. 16 © 2016 Citrix
• User should be member of only one group to have access to both published resources as
well as required Citrix infrastructure
• Use proper group nesting instead of adding user to two groups
• Proper nesting design helps with de-provisioning of privileges

17. 17 © 2016 Citrix
• User should be member of only one group to have access to both published resources as
well as required Citrix infrastructure
• Use proper group nesting instead of adding user to two groups
• Proper nesting design helps with de-provisioning of privileges

18. 18 © 2016 Citrix
• User should be member of only one group to have access to both published resources as
well as required Citrix infrastructure
• Use proper group nesting instead of adding user to two groups
• Proper nesting design helps with de-provisioning of privileges

19. 19 © 2016 Citrix
• User should be member of only one group to have access to both published resources as
well as required Citrix infrastructure
• Use proper group nesting instead of adding user to two groups
• Proper nesting design helps with de-provisioning of privileges

20. 20 © 2016 Citrix
This is more of what people

21. 21 © 2016 Citrix
These are default roles (with exception of Custom)

22. 22 © 2016 Citrix
Ongoing process – this should not be only during initial build - Regularly review privileges and
remove when no longer necessary

23. 23 © 2016 Citrix
Principle of least privilege is one of the ways how to minimize the impact after security
breach. Another way is through the proper network segmentation and Kurt is going to talk
about that approach.
Super accounts – instead of creating multiple accounts for different roles, single powerful
account is often being used.

24. 24 © 2016 Citrix
• If possible use machine identities for authentication
• Hypervisor connection + PVS
Principle of least privilege is one of the ways how to minimize the impact after security
breach. Another way is through the proper network segmentation and Andy is going to talk
about that approach.

25. 25 © 2016 Citrix
Recommended implementation steps
• Same principles applies to the firewalls for example. Start with open network, make sure
everything works, enable FW.

26. 26 © 2016 Citrix

27. 27 © 2016 Citrix
Script
The first thing I want to talk about is secure network zones.
The concept is that sensitive data is wrapped up in multiple layers of protection called zones.
Each zone has increased security requirements over the previous one.
Each zone can contain one or more dedicated networks and firewalls are used to restrict
communications between zones and networks within zones.
Confidential data that it is transferred between or within zones should always be protected
using encryption.
Reference
https://www.atsec.com/downloads/pdf/ISSE_2009-Secure_network_zones-
Peter_Wimmer.pdf

28. 28 © 2016 Citrix
Script
The outermost zone is called External and includes devices and networks that are not
controlled by the organization. For example, Internet users and partner companies. Rather
predictably, the external zone is the least trusted zone in the model.

29. 29 © 2016 Citrix
Script
The second zone is called Presentation and includes internal client LANs and the networks
containing SBC and VDI machines. This zone is the first one managed by the organization and
the most likely to be attacked.

30. 30 © 2016 Citrix
Script
The third zone is called Application and contains the app servers and logic used to process
data.
The Application zone also includes the management network because it needs to
communicate with the yellow and red zones.

31. 31 © 2016 Citrix
Script
The innermost zone is called the Data zone and includes important infrastructure like
database servers. This is the most protected zone in the organization.

32. 32 © 2016 Citrix
Script
There is one important rule that you you should remember about secure network zones.
Network traffic can only move between adjacent zones, it can’t jump zones. We do this to
prevent sensitive data from being accessed directly from insecure networks.
Based on my experience, most customers do a really good job with the External and
Presentation zones but don’t do very much with the application and data zones. There is a
really big opportunity here to help customers improve their security.

33. 33 © 2016 Citrix
Script
Let’s see how this concept works out for a XA / XD deployment. Each box in this diagram
represents a separate network within the relevant zone
The firewall between the presentation and application zones is configured to ensure that only
finance desktops can access the finance app server and only Human Resources desktops can
access the HR app server.
The firewall between the application and data zones is configured to ensure that the
database servers can only be accessed by the relevant app servers.

34. 34 © 2016 Citrix
Script
This slide shows you how the secure network zone concept maps to the XA and XD control
infrastructure.
In this example we have three networks for the presentation zone, 1 for application and 1 for
data. Remember, it’s not possible for the presentation networks to directly access the data
network.
This diagram also shows important communication flows between each of the infrastructure
servers. We’re going to look at each of these flows and talk about why they should be
encrypted and how to do it.
Reference
http://support.citrix.com/article/CTX137556s/documents/about/citrix-xenapp-and-
xendesktop-76-fips-140-2-sample-deployments.pdf
http://www.basvankaam.com/2014/11/24/the-ultimate-xendesktop-7-x-internals-cheat-
sheet/

35. 35 © 2016 Citrix
Script
Why
StoreFront encryption is a priority because user credentials are transferred using obfuscation
and not encryption. Encryption requires an algorithm and a key while Obfuscation just
requires an algorithm making it much easier to crack than encryption.
How
So how do we encrypt StoreFront traffic?
Install a private or public certificate on the StoreFront servers, and then add the certificate to
the https binding for the site. It’s really important that you disable http traffic or chances are
users will just bypass the encryption.

36. 36 © 2016 Citrix
Script
Why
I recommend that you implement encryption for the Controller next because obfuscated
credentials are also passed between StoreFront and the Delivery Controllers as well as
NetScaler and the Delivery Controllers.
How
All you have to do is install a certificate on the Controller, a private certificate is fine as it’s just
going to be accessed by managed machines.
Once the certificate is installed run the command shown up here on the slide.
You can find the certificate thumbprint in the details tab of the certificate.
To find the GUID of the Citrix Broker Service use the PowerShell command Get-
BrokerController.
Reference
http://support.citrix.com/article/CTX200415
How to create a web server SSL certificate manually -
http://blogs.technet.com/b/pki/archive/2009/08/05/how-to-create-a-web-server-ssl-
certificate-manually.aspx
How to configure a port with an SSL certificate - https://msdn.microsoft.com/en-
us/library/ms733791(v=vs.110).aspx
Certreq.exe syntax - https://technet.microsoft.com/en-us/library/cc736326(WS.10).aspx

37. 37 © 2016 Citrix
Script
Once the certificate is installed and the broker service has been configured, update
StoreFront and NetScaler to use https for the XML brokers and Secure Ticket Authority.
Finally, configure the XML service on the Controllers to ignore HTTP requests by setting
XmlServicesEnableNonSSL to 0.

38. 38 © 2016 Citrix
Script
Why
You should encrypt HDX traffic to prevent an attacker from being able to watch everything
that a user is doing.
With the release of XenApp and XenDesktop 7.6 I is not possible to implement TLS encryption
that is FIPS approved from Receiver to the VDA.
How
To enable TLS encryption you need to add certs to the VDAs, and then configure the VDAs
and Controllers to use encryption.
We’ll look at each of these steps in more detail because there are some important things to
consider.
Reference
http://docs.citrix.com/en-us/xenapp-and-xendesktop/7-6/xad-security-article/xad-ssl.html
https://www.citrix.com/blogs/2014/10/16/xenapp-and-xendesktop-7-6-security-fips-140-2-
and-ssl-to-vda/
https://www.citrix.com/blogs/2014/12/11/how-to-secure-ica-connections-in-xenapp-and-
xendesktop-7-6-using-ssl/
https://www.citrix.com/blogs/2015/07/13/xenapp-xendesktop-what-crypto-is-my-session-
using/

39. 39 © 2016 Citrix
Script
The first step is to deploy certificates to the VDAs.
This is super easy for dedicated desktops but much harder for pooled desktops which are
reset following a reboot. One solution is to add a wildcard certificate to the master image
such as *.Citrix.com. The problem though, is that if any of the VDAs are compromised, all
other VDAs are at risk.
A much better option is to use Microsoft Certificate Services to automatically provision
certificates using group policy. A startup script is then used to enable TLS.
This approach will only work for Desktop VDAs. For Server VDAs, the ICA listener is brought
up too early during the boot process, before certificates can be automatically provisioned.
This doesn’t stop you implementing encryption for non-provisioned server VDAs though.

40. 40 © 2016 Citrix
Script
Once you have the cert installed on the VDA you need to run a PowerShell script that enables
TLS on the VDA. You can use a few different parameters with the script.
The SSLMinVersion parameter can be TLS_1.0, TLS_1.1 and TLS_1.2. The script will use
TLS_1.0 by default.
The SSLCiperSuite parameter allows you to select your preferred cipher suite which can
include Government, Commercial and All.
The certificate thumbprint parameter allows you to specify which certificate you want to use.
Most of the time you won’t need this parameter as you’ll just have one cert on the VDA.

41. 41 © 2016 Citrix
Script
The last step is to enable encryption on the controller.
There are two PowerShell commands that you need to run on each controller. The first one
enables TLS for all delivery groups. You can also enable TLS for individual delivery groups if
you wish.
The second PowerShell command changes the address of the VDA in the ICA file from IP
address to FQDN so that it matches the name in the certificate.

42. 42 © 2016 Citrix
Script
Why
The Controller communicates with the hypervisor to create and manage VMs. This includes
the initial authentication, during which the username and password of the service account
are sent over the wire.
How
To secure the hosting traffic use TLS encryption for XenServer and vSphere. Make sure that
your customers use trusted certs rather than the default non-trusted vendor certs.
If you have Hyper-V, the Controller will automatically leverage the WCF protocol to secure the
traffic.

43. 43 © 2016 Citrix
Script
The last network flow we’re going to take a look at is between the Controller and SQL which
can include confidential data.
To enable encryption, add a certificate to your SQL server, a private cert is fine.
Configure the server to accept encrypted connections by opening SQL Server Configuration
Manager, select the certificate that you want to use, and switch the force encryption flag to
yes.
Reference
https://msdn.microsoft.com/en-us/library/ms191192(v=sql.110).aspx

44. 44 © 2016 Citrix
Script
As you can see, all communications are now green and we have TLS between and within 3
zones and 5 networks. Once you’ve confirmed that everything works with encryption
enabled, you’re ready to start locking down the traffic between zones and networks using the
firewalls.

45. 45 © 2016 Citrix
Script
Most customers use default port numbers now due to the availability of good network
scanners but there is a really interesting use case that I want to talk about. By default, many
of the FMA services use the same port for different functions. For example, the broker service
uses port 80 for VDA registrations, XML requests and the SDK. This prevents us from
implementing granular firewall rules for each of these different functions.
The good news though is that you can configure an FMA service to use different port
numbers for different functions. From a command prompt, query the executable of an FMA
service to see what options you have.

46. 46 © 2016 Citrix
Script
In this example, I’ve run a command that configures the broker service to use different ports
for the VDAs, StoreFront and the SDK.
This allows me to configure the firewalls so that NetScaler is the only machine outside of the
server network able to query the XML broker.
Similarly, I can limit VDA port access on the controller to the VDA network and the SDK port
to the management network.

47. 47 © 2016 Citrix
One of the most important principles of security is called defense in depth (also known as
castle approach). The strategy is based on the military principle that it is more difficult for an
enemy to defeat a complex and multi-layered defense system than to penetrate a single
barrier.
What we are going to do here is to have a look at what attacked would do, based on scenario
where he have access to one published application.

48. 48 © 2016 Citrix
Attacker has been able to get access to testtemp account with password
“YourCompany123”. He found the account by looking for *temp**test**tst* or anything
with “_”.
App A (Notepad) is published to Domain Users – it is just a simple test application, so why
would you have a dedicated group used for publishing, right?
Combination of open test account and app published to Domain Users, he can establish a
session to one of the XA servers.

49. 49 © 2016 Citrix
As the next step, he will try to break out of the application and start command prompt (or
task manager etc.) to access the rest of the operating system
Now, if you believe that standard GPO policies will help you…

50. 50 © 2016 Citrix
Publishing filtering should not be considered a security feature.

51. 51 © 2016 Citrix
…think again. Especially if many applications are published, it’s very tough to secure such
environment. Assume that attacker will always find a way.
Example above has bypassed some of the common security policies
• Restrict C drive – accessing it through local host instead
• Prevent access to the command prompt – PowerShell ISE is not disabled
• File dialog – Using print as PDF instead
So, assuming that you cannot prevent this from happening, what can you do?

52. 52 © 2016 Citrix
Goal – Explain that just by hiding something, it doesn’t mean its secured as well.
Would you publish application that is available to all users (Domain Users), is extremely hard
to secure (Office) and contains its own scripting engine (Office VBA) on the same server as
your payroll application that is available only to a very limited number of users?

53. 53 © 2016 Citrix
Goal – Explain that just by hiding something, it doesn’t mean its secured as well.
Would you publish application that is available to all users (Domain Users), is extremely hard
to secure (Office) and contains its own scripting engine (Office VBA) on the same server as
your payroll application that is available only to a very limited number of users?

54. 54 © 2016 Citrix
Goal – Describe that groups should we always used and specific users should be avoided.
Also, if possible, try to avoid anonymous users or shared accounts. This can often be a
balance between economic aspect and security aspect – but from security perspective, it
should be always possible to link user account to specific name.

55. 55 © 2016 Citrix
Goal – Describe that groups should we always used and specific users should be avoided.
Also, if possible, try to avoid anonymous users or shared accounts. This can often be a
balance between economic aspect and security aspect – but from security perspective, it
should be always possible to link user account to specific name.

56. 56 © 2016 Citrix

57. 57 © 2016 Citrix

58. 58 © 2016 Citrix
DNS tunneling

59. 59 © 2016 Citrix
http://blogs.technet.com/b/fdcc/archive/2011/01/25/alwaysinstallelevated-is-equivalent-to-
granting-administrative-rights.aspx
We have already taken enough of your time that you could spend securing your environment
or selling security related services to your customers, so it is time to wrap up our
presentation.

60. 60 © 2016 Citrix
So to wrap up, we want to leave you with a few actionable takeaways and tools that will help
you set up your own security focused services.

61. 61 © 2016 Citrix
https://www.citrix.com/about/legal/security-compliance/common-criteria.html

62. 62 © 2016 Citrix
There are also a number of Microsoft tools to help you analyze customer environments and
create a baseline configuration as well as confirm compliance to industry best practices

63. 63 © 2016 Citrix

64. 64 © 2016 Citrix
You might be wondering how much we know about your experience with our products, and
what we’re doing to improve product quality and make your experience better.
Our product supportability efforts are the result of paying attention to the issues and
concerns you raise when engaging with our Support teams as well as the feedback you
provide to our Sales and Consulting groups.
The details you see here speak to some of the work we’ve done already, and where we’re
currently focused.
For more details on supportability efforts, visit: www.citrix.com/supportability

65. 65 © 2016 Citrix

66. 66 © 2016 Citrix