3111 Securing The Corporate Datacenter With Citrix Access Gateway Final.ppt

securingthecorporatedatacenterwithcitrixaccessgateway timsimmonssr mgr technicalmarketingcitrixsystems inc aaroncockerilldirector productmanagementcitrixsystems inc agenda today smodel financesubnet wirelessnetwork fileservers web appservers presentationserver e mailservers datacenter firewall firewall dmz internet ids domainservices assumptions thecorporatenetwork trustedmachinescanhostuntrustedsoftwaremoremobileusersmorepublicaccesspointsmalwareisincreasingsplittunnelsonremotevpnconnections 1 onlytrustedmachinesconnecttothecorporatenetwork themalwarethreat althoughwesawasteadydeclineintherateofvirusesproducedfrom2000to2004 downtoa5 yearoveryeargrowth we veseena20 increaseinmalware relatedthreatsbetween2004and2005 andanticipatethatthesenumberswillstayatthehigherrateofgrowthfortheimmediatefuture vincentgullotto vicepresidentofmcafee ssecuritylab avert assumptions trustedvisitorsaccesstowiredconnectionsrogueaccesspoints 2 onlyemployeesconnecttothecorporatenetwork assumptions 3 authenticatedusersshouldbetrustedonthenetwork osimodel assumptions applicationsmaytransmitsensitivedataunencryptedduetousererrorconfigurationerrorpoorsoftwaredesign 4 applicationscommunicatesecurelyonthenetwork web appservers threatsummary untrustedmachinesonthenetworkmalwaresplittunnelsonvpnconnectionsnetworkinfrastructureisnotuser awareunencryptedsensitivedataonthenetwork themodelneedstoevolve enclavemodel internet firewall firewall firewall fileservers web appservers presentationserver e mailservers datacenter domainservices firewall firewall dmz ssl vpngateway enclavesupportservices datacenter userenclave firewall internet enclavemodel internet firewall firewall firewall fileservers web appservers presentationserver e mailservers datacenter domainservices firewall accessgateway wirelessaccesspoints ssl vpngateway datacenterdeployment netscalerload balancer datacenter fileshares webservers advancedaccesscontrolservers accessgateways enterpriseresourceservers exchange notes citrixpresentationserver activedirectorydomain firewall fromuserenclavenetworks accessgateway4 2 accessgatewayintegratedwithadvancedaccesscontrolnomoresoftwaresecuregatewayinaacpackagesgcontinuestoshipwithpresentationservernewadvancedaccesscontroluserinterfacenavigationuiincludespresentationserverapplicationssupportfordoublesourceauthentication e g ad rsa newblackbezelrenameaccessgatewayenterpriseto accessgatewayandadvancedaccesscontrol multi lingualsupport what snew standardag aacdeployment firewall firewall clientdevice securecontrolchannel soap advancedaccesscontrol fileservers e mailservers ippbx web appservers presentationserver ag aactraffic browser based firewall advancedaccesscontrol firewall fileservers e mailservers ippbx web appservers presentationserver ag aactraffic ica cgp firewall firewall fileservers web appservers presentationserver e mailservers ippbx advancedaccesscontrol securecontrolchannel ag aactraffic vpn firewall firewall fileservers web appservers presentationserver e mailservers ippbx advancedaccesscontrol securecontrolchannel smartaccess advancedendpointsensing userscenario whichuser analyzeaccessscenario analyzeendpointtoensureconnectionsare safe ensureconnectionwillnotharmcorporateinfrastructuretrusted analyzeuser machine andnetworkidentitytoensuretheconnectionisbeingmadeasclaimedsecure ensuremaliciouspartiescannotattackcorporateinfrastructurefromconnectingdevicesprovideanextensiblearchitecture viasdk toallowcustomersand3rdpartiestoeasilycreatecustomscans smartaccess overview analyzeaccessscenario machineidentity netbiosnamedomainmembershipmacaddressmachineconfigurationoperatingsystemanti virussystempersonalfirewallbrowsernetworkzoneloginagentauthenticationmethodcustomendpointscans smartaccess overview analyzeendpoint connection implementaccesscontrol cpsapplicationsfile networkshares uncs webbasedemailwebsites urls webapplicationsemail applicationsynchronization machineidentity netbiosnamedomainmembershipmacaddressmachineconfigurationoperatingsystemanti virussystempersonalfirewallbrowsernetworkzoneloginagentauthenticationmethodclientcertificatequeriescustomendpointscans policybasedaccesscontrol situationalorcontextualaccesscontrolbasedonusermembership authenticationstrength deviceandconnectiontoensureitresourcesarenotexposedtounwarrantedrisk fulldownloadofdocumentsliveediteditlocallysavebacktoserverretaininmemoryduringeditavoiddataleakageonclientpreviewdocumentswithhtmlaccessfrompdasviewwithoutapplicationonclientattachtoemailavoiddatatransmissiontoclientcpsapplicationscontrolavailableapplicationslimitlocalmappeddrives printing analyzeendpoint connection implementaccesscontrol implementresourceusagecontrol cpsapplicationsfile networkshares uncs webbasedemailwebsites urls webapplicationsemail applicationsynchronization machineidentity netbiosnamedomainmembershipmacaddressmachineconfigurationoperatingsystemanti virussystempersonalfirewallbrowsernetworkzoneloginagentauthenticationmethodcustomendpointscans smartaccess overview intellectualpropertycontrol managetheuseofsensitiveinformationby controllinghowinformationisaccessedandused cps htmlpreview liveeditetc controllingwhatcanbedonewiththatinformation download print save copy etc ensuringnodataisleftonthelocalmachineenablecompaniestologallaccess ssl vpns accessmethods fulldesktopexperienceclient serverapplicationsweb basedapplicationsvoiceoveripsoftphones granularaccesscontrols filepreviewwebe mailcontrolledpresentationserveraccess filedownloadlocaleditandsavefileupload e mailsyncwebe mailfullpresentationserveraccessfullpresentationserverappset editinmemorylimitedpresentationserveraccess read onlylocaldrivemapping limitedpresentationserverapplicationsetfilepreviewfileuploade mailsyncwebe mail publickiosk intelligentnetworks networkinfrastructurevendorsarebuilding intelligentnetworks technologyisstillindevelopmentrequiresareplacementofexistingfirewalls switches androuters citrixaccessgatewaybenefits improvedmanagementandcontrol ensureclientdevicesaresecuredpriortoaccesshelpstoreduceadministrativeerrorsgreatervisibilityintonetworkactivities citrixaccessgatewaybenefits improvedmanagementandcontroladdressregulatorycompliance documentprotectionstrongauthenticationauditing logging citrixaccessgatewaybenefits improvedmanagementandcontroladdressregulatorycomplianceenhancednetworkpolicies adaptivepolicybasedaccesscontrolgreaterintelligenceresultsinbetterdefense citrixaccessgatewaybenefits improvedmanagementandcontroladdressregulatorycomplianceenhancednetworkpoliciesallnetworktrafficissecure secure encrypted communicationsenhancesintrusiondetectionsystems userid ip restrictvisitoraccess citrixaccessgatewaybenefits improvedmanagementandcontroladdressregulatorycomplianceenhancednetworkpoliciesallnetworktrafficissecuresimplifywirelessnetworks minimizecomplexityassociatedwithleap eap wep wpa etc citrixaccessgatewaybenefits improvedmanagementandcontroladdressregulatorycomplianceenhancednetworkpoliciesallnetworktrafficissecuresimplifywirelessnetworksmitigatethreatstothenetw