White paper. Security Beyond Corporate Boundaries. Using Citrix Application Delivery to Protect Corporate Information Anywhere Business Happens

Transcription

1 White paper Security Beyond Corporate Boundaries Using Citrix Application Delivery to Protect Corporate Information Anywhere Business Happens

2 Table of contents Security Beyond Corporate Boundaries Using Citrix Application Delivery to Protect Corporate Information Anywhere Business Happens Executive Summary... 3 Introduction... 3 Application Delivery with Citrix XenApp... 6 Conclusion... 8

3 Executive Summary Ironclad security has become the Holy Grail for companies looking to protect corporate and customer information at large in the modern enterprise. The move toward greater data distribution thanks to growing globalization and worker mobility is taking this sensitive data well outside the corporate network and creating new vulnerabilities in the process. As corporate data becomes increasingly difficult to protect, security takes top priority for most IT organizations. However, deploying the latest firewall, antivirus or encryption tool can t ward off today s sophisticated intruders. Not just hackers, but organized crime, dishonest insiders and unfortunate mistakes are easily finding their way past these deterrents, especially when critical data lies outside of IT control. What s more, keeping on top of the threat is stretching IT resources to their limits. Traditional security controls, which demand constant and immediate updates and attention, are just not enough. A new worm attack, stolen laptop or cunning access override can quickly snowball into disaster, further escalating when a user device must be individually deployed and maintained. Also, access controls as well as other security measures are hindering end user productivity, adding to IT headaches. Throwing more tools at the problem is not the answer. Instead, an entirely new approach is needed to address IT s security challenges something that takes location out of the equation and promises to protect important corporate interests wherever they may be. Citrix XenApp (the new name for Citrix Presentation Server ) is such a solution, turning away from traditional application deployment to application delivery, whereby IT retains complete control over the corporate data that is created, shared and disseminated in the thousands of applications at work in the enterprise. With application delivery, only an application s interactive components are dynamically delivered to the end user while the application and its corporate data stay on the host server. Read on to discover how Citrix XenApp s application delivery offers a new and smarter approach to security, giving IT the ultimate control it needs to ensure security and regulatory compliance without compromise to business performance and productivity. Introduction Over-distribution of data is escalating security exposure. Today s business takes place everywhere and anywhere. Rapid global expansion and increasing workforce mobility are catapulting organizational information into new and uncharted worlds. Over the Internet, on laptops, in field offices abroad, on handhelds, at home, wherever today s corporate data is in use, and at risk, in more places and in more ways than ever before. As business expands, so do its touch points with sensitive corporate data passing through scores of user devices, work locations and business applications. Never before has this data been more prolific or vulnerable. And with each touch point serving as a site for potential breach, never has security been a more important or elusive goal. 3

4 Professional hackers, organized criminals, identity thieves and corporate enemies are poised to take advantage of these vulnerabilities with ever more sophisticated tactics and threats. Even a single security breach compromising customer information, for example can cost an organization millions of dollars not to mention priceless consumer confidence. Insider threats are also on the rise, with as much as one in five security breaches occurring within company walls. 1 Data loss and compromise from malicious insiders (as well as preventing costly security mistakes) are an ever-increasing concern in today s heavily regulated industries. Companies must be prepared to guard against these intrusions. As such, not surprisingly security has moved front and center of the IT agenda, taking up considerable budget and resources. In each company, a whole host of security tools are at work at any given time firewalls, antivirus protection, access restraints, to name a few draining considerable IT time and attention. But these traditional security measures fall far short when it comes to controlling information that must be accessible outside corporate boundaries. Traditional security measures don t scale beyond corporate boundaries. Like it or not, the corporate perimeter is dissolving making it hard to define, let alone defend. It s no longer enough to shore up the company network and other company-controlled systems. Now companies must find ways to protect critical data wherever it ventures outside of corporate and IT constraints. Corporate Information Lives In Applications Most corporate data is created, shared, and disseminated on the various user applications that are the lifeblood of the enterprise worker productivity tools, transactional applications and so forth. Some organizations have hundreds if not thousands of different applications in operation throughout their organization. These applications are at use on any number of end user devices desktop PCs, laptops, PDAs, etc. and wherever people are hard at work in the field, at home, on an airplane. Gaining control over this data is the key to maintaining security. Think Outside The Firewall Yet this isn t easy to do when security efforts are squarely network focused. How do you track user activity when an employee is working at home, for example, and off the Virtual Private Network (VPN) grid? With the lines now blurred between internal and external networks as well as between inside and outside the firewall, it just makes more sense to take the network out of the equation. Point Products Miss The Point Meanwhile, other traditional security measures aren t filling in the gaps. Antivirus and anti-spyware software are useful threat prevention point products; however, certain scenarios have to hold true and steady for them to be effective. Primarily operating in a negative security model, they must be continually updated and modified in order to remain relevant a weighty task when deployed enterprise-wide. As vital components of a security arsenal, they are not a security solution in and of themselves, providing limited protection outside of the corporate perimeter. Restricted Access Falls Into The Wrong Hands Recognizing these inadequacies, many IT organizations rely on restricting access to mitigate risk. Enforcing strict barriers to entry ensures that corporate data gets into only the right hands. Or does it? Only too often, access is an all or nothing proposition. Once access is granted, anything goes. Data can be copied, printed, distributed and destroyed with little to no control. Most access policies are not granular enough and/or don t accommodate the many work scenarios of the modern enterprise or how these scenarios may require quick change or modification of access policies and controls. When access is unduly limited or cumbersome, worker productivity suffers. 1 Securing the Network from the Inside Out, Forrester Research, Inc.,

5 Often, these same workers find creative ways to work around security controls to get their jobs done, resulting in further exposure. This can often be a high price to pay for security measures that, in the end, prove to be inadequate. Out With The Old The bottom line: Traditional security measures do not stand up to modern enterprise and regulatory compliance demands. These outdated modes rely on deploying security controls using a traditional application deployment model, and then trying in vain to manage what is beyond their control. Ultimately, this approach is inefficient and unsafe, yielding diminishing returns. Corporate PC: A constant reactive struggle to secure How much data is staying outside of your organization? Printed Copies: How do you control who reads them? Laptops: How much sensitive data is at risk if lost or stolen? Firewall: Is everything on the inside really safe? Datacenter: The only place you can fully secure, physically and logically Day Extenders: Who is watching them? Contractors: How much of your data can they see? The Insecure Enterprise Traditional tools do not extend far enough to protect critical business data. LASON India, a leading business process outsourcing (BPO) company USA is using Citrix to ensure 100% security of customer data, while also increasing by 300% the productivity of online BPO jobs. View the complete case study at com/english/aboutcitrix/ casestudies/casestudy. asp?storyid= Companies must rethink security to focus on data and not the network. To meet these challenges, companies must adopt a new approach to security that defies traditional tools and focuses on protecting sensitive corporate data in use throughout the organization and beyond. With such an approach, security would complement the way organizations do business. All application data, regardless of user device or location, would be under complete IT control. This data, while still at large and in use across the enterprise, could remain housed at the corporate datacenter and not free to roam outside of corporate restraints. IT would be able to exercise its control intelligently, based on true and complete insight into user activity. IT could then use this insight to delegate access and use of data using granular controls that could be easily and quickly modified for various work scenarios allowing view only for one application and print capabilities with another, for example. In turn, all activity would be captured in a way to provide total accountability for data behavior so that compliance requirements are easily met. Finally, this new approach would provide tight security without compromise to user productivity and performance. Users would need just one password for access, and not one for each access scenario. All security measures remain transparent to the end user to ensure that business is not disrupted. 5 Companies can now create a safer environment for their data while also dramatically improving the way applications are supported and maintained. It s no longer practical, or necessary, for full applications complete with all their inherent data and code to travel great distances and put critical corporate information at risk. Application delivery with Citrix XenApp makes security a reality.

6 Application Delivery with Citrix XenApp Keep critical business data under complete IT control. Citrix XenApp is an essential component of the application delivery infrastructure. XenApp streamlines security by leveraging application delivery, not deployment, to support an organization s regulatory compliance and security objectives. With application delivery, the end user receives only what s needed for interaction with the application when, where and while its needed while the application, as well as all of its associated data, are safely back at the datacenter under complete corporate and IT control. Applications can be virtualized and/or streamed to provide the best experience for connected and disconnected usage. XenApp s additional built-in measures also further underscore security and protections, including advanced access tools and password management. With application delivery, virtualization technologies abstract applications from the host operating system to run on any device. This has tremendous implications for security and regulatory compliance, not to mention overall organizational productivity. The same benefits that are already at work around the globe helping companies quickly and cost-effectively manage their applications, are now transforming the ways companies approach security. Let s look at more ways in which XenApp s application delivery enhances security efforts: Citrix XenApp: The Industry Leading Solution for Delivering Windows Applications at the Lowest Cost Anywhere Citrix XenApp is an endto-end application delivery system that offers both client-side and server-side application virtualization for optimal application performance and flexible delivery options. With the secure application architecture, organizations can centralize applications and data in secure datacenters, reducing costs of management and support, increasing data security, and ensuring fast, reliable performance. The Datacenter Has It XenApp prevents data from leaving the datacenter without explicit permission. With applications back at the datacenter, and not scattered throughout the enterprise, it s much easier to keep an eye on applications, and their related data. The host server dynamically updates each session, ensuring that all security fixes and updates are current and accounted for. And the applications run virtualized and isolated from the client OS environment. Without the need for extensive testing to certify applications, regulatory compliance is greatly facilitated. Also, the ability to place limitations on application use and dissemination gives IT even more control. For All Users In All Locations The underlying premise of application delivery separating the use of application from where the application lives enables IT to house and protect sensitive corporate information without influence of network conditions or end user computing device. The user s physical location and machine of choice are rendered irrelevant. With application deployment, on the other hand, applications and their data live on an individual device, which is difficult, if not impossible, to secure. Instead, IT need only focus on fortifying security efforts at the datacenter where security fixes and access policies are quickly and easily implemented for the entire organization. Real-life Insight Guides Policy Controls XenApp provides great insight into user activity to support the intelligent use of policy controls based on real-life scenarios and not generalized network use. Built-in endpoint scans and policy controls take into account each user s role, device characteristics and network conditions to determine which applications and data they are authorized to access. This access defines whether the user is automatically connected to a particular set of applications directly, virtualized or not allowed access at all. These dynamic attributes also define where users may store and print sensitive information. Such strong data and application security measures decrease the potential for inadvertent exposure, and enhance the ability to back up and restore information from one place for greater fault tolerance, 6

7 How It Works: Application Virtualization XenApp s application delivery relies on virtualization to circumvent deployment by isolating, or abstracting, applications on the host server and then delivering only the application code required by the user operation on demand. The user gains access through a simple network login to connect with a picture of the application. The delivered application is fully sandboxed from the user OS, registry, applications and data allowing IT to define any required interaction and deny any prohibited interaction. Two kinds of virtualization technology must be at work in order to accommodate all of today s user work scenarios: Server-side virtualization provides access to the application residing in the datacenter. Only the keystrokes, mouse clicks and screen refreshes pass from the user device to the apps in the datacenter. Client-side virtualization (also referred to as application streaming ) isolates the application temporarily on the user device while off-line, say on an airplane, and then dynamically updates and synchronizes with the datacenter once a network connection is restored. disaster recovery and reduced backup footprint. Furthermore, performance monitoring is visually represented to give a precise picture of the end user experience providing that added layer of detail needed for regulatory compliance. Granular Access Based On Business and Security Priorities Integrated single sign-on and a secure SSL VPN gateway for remote access enable a one password, one path approach to application and data access. No need for many different passwords, a single sign on allows users to access what they need to get work done regardless of device, location or application. This enables integrated SSO and strong authentication not possible in other environments without slowing user and IT productivity. Security Measures Deployed Fast and Efficiently. Because an application lives at the datacenter and delivered over the network, it need only be packaged once on the server(s) to easily scale to thousands of devices. XenApp can then virtualize or stream the application to end users. Security fixes are quickly and uniformly rolled out across the enterprise in minutes or hours, instead of weeks or months and with significantly fewer IT staff and resources. As only the latest application version gets delivered, conflicts are easily addressed and eliminated from the user experience. Citrix XenApp, Platinum Edition takes security to the next level. XenApp, Platinum Edition is Citrix s comprehensive application delivery system that builds on the industry s standard for Windows application delivery with added capabilities that extend manageability and security. These advanced features of XenApp, Platinum Edition take security to the next level: Granular Control with SmartAccess Powered by the Citrix Access Gateway product line of SSL VPN appliances, Citrix SmartAccess delivers granular access control policies and integrated endpoint analysis. SmartAccess improves productivity without compromising security by analyzing the access scenario and delivering the appropriate level of access, including control of actions such as print, save and edit. Other SSL VPNs can only provide rudimentary on/off access capability. Strong Authentication with Single Sign-On Citrix Single Sign-On, powered by Citrix Password Manager, enables organizations to centralize password management for greater IT control, while users experience the productivity gains of fast, automated logons to Web, Windows and host-based applications. Single Sign-On strengthens application security and eliminates the security breaches that are common when users have more passwords than they can manage. True Picture with SmartAuditor Citrix SmartAuditor uses flexible policies to trigger visual recordings of XenApp sessions automatically. IT can now monitor, record and examine user activity from start to finish. This demonstrates internal control, which helps ensure regulatory compliance and successful security audits of applications, including financial operations and healthcare patient information systems. SmartAuditor complements activity logs, providing for both textual and visual representation of the application and end user activities. Deep Visibility with EdgeSight Citrix EdgeSight software brings advanced application performance monitoring to XenApp, enabling IT to quickly pinpoint and troubleshoot server, network and application programming issues that impact performance. Gain deeper insight by capturing the actual end user experience, instead of merely monitoring the health of plumbing (networks, servers and underlying infrastructure). Ensure that all security measures are operating at peak efficiency and in support of business objectives. 7

8 Fill out the solution with other Citrix products. These other Citrix products work hand in glove with XenApp to further solidify security efforts: Citrix NetScaler Citrix s purpose-built Web application delivery solution that accelerates application performance up to five times while improving security and reducing Web infrastructure costs. Citrix Provisioning Server for Datacenters Citrix s provisioning powerhouse dynamically streams and updates workloads to any server, extending XenApp s application delivery capabilities. Citrix XenDesktop The industry s first comprehensive Virtual Desktop Infrastructure (VDI) solution. It enables simple, secure and cost effective delivery of Windows desktops to any office worker with an unparalleled user experience. Citrix XenServer Citrix s full managed virtualization platform quickly multiplies XenApp s security muscle by enabling golden build from a single console. Conclusion The time has come to adopt a security approach that extends beyond the enterprise. IT must protect all corporate data regardless of where it is or how it s used throughout the enterprise. By embracing delivery, organizations have a vehicle to rethink how they safeguard information beyond the network. Citrix XenApp s application delivery system can dramatically improve security and protect critical corporate data by delivering, not deploying, the applications that carry this critical data. When applications and their associated data remain at the datacenter, and only when, IT will gain maximum control over corporate information to bring true security to its organization. With XenApp, Platinum Edition provides: Comprehensive application delivery system using both client- and server-side virtualization to accommodate any user scenario Security that transcends network conditions and end user computing device restrictions Single sign-on and strong authentication that allow security to be easy on the end user Granular access policies for powerful IT control Advanced visibility for deep insight into data and user experience True control from the application to the user required for comprehensive regulatory compliance Find out how Citrix can improve the delivery of your business-critical applications. Visit 8

9 Citrix Worldwide Worldwide headquarters Citrix Systems, Inc. 851 West Cypress Creek Road Fort Lauderdale, FL USA T T Regional headquarters Americas Citrix Silicon Valley 4988 Great America Parkway Santa Clara, CA USA T Europe Citrix Systems International GmbH Rheinweg Schaffhausen Switzerland T Asia Pacific Citrix Systems Hong Kong Ltd. Suite 3201, 32nd Floor One International Finance Centre 1 Harbour View Street Central Hong Kong T Citrix Online division 5385 Hollister Avenue Santa Barbara, CA USA T About Citrix Citrix Systems, Inc. is the global leader and most trusted name in application delivery infrastructure. More than 200,000 organizations worldwide rely on Citrix to deliver any application to users anywhere with the best performance, highest security and lowest cost. Citrix customers include 100% of the Fortune 100 companies and 98% of the Fortune Global 500, as well as hundreds of thousands of small businesses and prosumers Citrix Systems, Inc. All rights reserved. Citrix, Citrix NetScaler, Citrix XenDesktop, Citrix XenApp, Citrix Presentation Server, Citrix XenServer, Citrix EdgeSight, Citrix SmartAuditor, Citrix Password Manager, Citrix Access Gateway and Citrix SmartAccess are trademarks of Citrix Systems, Inc. and/or one or more of its subsidiaries, and may be registered in the United States Patent and Trademark Office and other countries. All other trademarks and registered trademarks are property of their respective owners. March