Securing Citrix Presentation Server in the Enterprise

Technical Editor......Page 1
Contributors......Page 3
Introduction to Security......Page 4
Security Guidance for Operating Systems and Terminal Services......Page 71
Terminal Services and XenApp Server Deployment......Page 159
What Is Terminal Services?......Page 160
The Dark Ages: The Birth of Windows NT 4.0 Terminal Server Edition......Page 161
The Renaissance: The Light of Windows 2000 Terminal Services......Page 164
The Future and Beyond: Capabilities of Windows Server 2003 Terminal Services......Page 167
Installing Terminal Services......Page 169
Load Balancing Limitations......Page 174
Secure Remote Access Solution......Page 175
Lack of an Enterprise Toolset for Management......Page 176
Lack of Built-in Application Deployment Solution......Page 177
Limited Client-Side Functionality......Page 178
History of Citrix XenApp Server......Page 179
XenApp Server Farms......Page 180
Single Server Farm......Page 181
Planning a Server Farm Project......Page 182
The IMA Data Store......Page 183
Local Host Cache......Page 184
The IMA Data Collector......Page 185
Data Collector Communication......Page 187
Independent Management Architecture......Page 188
The Future and Beyond: Capabilities of XenApp Server......Page 189
Management and Monitoring......Page 190
Application Publishing......Page 191
Security Improvements with XenApp Server......Page 192
Improvements in Terminal Services......Page 193
So, Where Are the Gaps?......Page 194
Session Disconnections and Reliability......Page 195
Web Interface......Page 196
Load Balancing......Page 197
Horizontal vs. Vertical Scaling......Page 198
Build In Redundancies......Page 202
Server Virtualization......Page 204
Manual Installation......Page 205
Unattended or Scripted Installs......Page 206
Server Cloning......Page 209
Server Provisioning......Page 211
Hybrid Approach......Page 213
Citrix XenApp Server Installation Process......Page 214
Planning for Home Folder and Terminal Server Profile......Page 216
View Installation Checklist......Page 221
Remap the Server Drives......Page 222
Create the Data Store......Page 223
Installing Microsoft SQL Express 2005 Desktop Engine with Service Pack 1......Page 224
Creating a Database with Microsoft SQL Server 2005......Page 225
Install the License Server......Page 226
Installing Internet Information Server......Page 227
Installing Citrix Access License Servers in a XenApp Environment......Page 229
Activate your Serial number and download a License file......Page 230
Install Citrix License Server......Page 231
Configure Delegated Administration......Page 232
Installing XenApp Server......Page 233
Summary......Page 252
Solutions Fast Track......Page 253
Limitations of Windows Server 2003 Terminal Services......Page 254
Platform Deployment Options......Page 255
Citrix XenApp Server Installation Process......Page 256
Frequently Asked Questions......Page 258
Understanding XenApp Security......Page 261
Defining XenApp Published Application Properties......Page 279
Security Guidance for Citrix XenApp Server......Page 319
Policies and Procedures for Securing XenApp......Page 409
Locking Down Your XenApp Server......Page 489
 Security Guidance for ICA and Network Connections......Page 558
Configuration of the RDP Protocol......Page 559
Controlling Connection Access......Page 563
Configuration of the ICA Protocol......Page 564
Configuring TCP Ports......Page 566
Multihomed servers......Page 567
XenApp Zones......Page 569
Connections via Program Neighborhood Agent......Page 570
Connections via Program Neighborhood......Page 571
Kerberos Pass-Through Authentication......Page 572
Selecting a Server Location Protocol......Page 574
Configuring Certificate Revocation List Checking......Page 578
Connections via the Web Interface......Page 580
Connecting through a Proxy Server......Page 581
Additional Client Configuration Settings......Page 583
Understanding Internet Protocol Security......Page 584
Securing Data in Transit......Page 585
Transport Mode......Page 586
ESP......Page 587
AH......Page 588
IPsec Components......Page 589
Determining Organizational Needs......Page 590
Using the IP Security Policy Management MMC Snap-in......Page 591
Secure Server Require Security......Page 593
Custom Policies......Page 594
Using the IP Security Policy Wizard......Page 595
Active Directory Based IPsec Policies......Page 600
Firewall Packet Filtering......Page 601
IPsec Configurations for XenApp......Page 602
The Function of the PKI......Page 606
Understanding Digital Certificates......Page 607
Machine Certificates......Page 608
Subordinate CAs......Page 609
Certificate Requests......Page 610
Certificate Revocation......Page 611
Fault Tolerance......Page 612
Securing Your License Server......Page 613
Solutions Fast Track......Page 615
Understanding Internet Protocol Security......Page 616
Securing the Citrix License Server......Page 617
Frequently Asked Questions......Page 618
Securing Access to XenApp Using Citrix Secure Gateway......Page 620
Methods of Remote Access......Page 621
Secure ICA......Page 624
Secure Socket Layer Relay SSL Relay......Page 630
Private Networking to Secure ICA Sessions......Page 631
Citrix Secure Gateway......Page 633
Citrix Access Gateway......Page 634
Citrix Secure Gateway Components......Page 636
Secure Ticket Authority Configuration......Page 637
Secure Gateway Installation and Configuration......Page 641
Web Interface Configuration to Allow for Secure Gateway Connections......Page 662
Citrix Secure Gateway Components......Page 666
Frequently Asked Questions......Page 667
Auditing and Security Incidents......Page 668
The Auditing Process......Page 669
Why Is Auditing Important?......Page 670
Internal Network Security Assessment Methodology......Page 671
Process for Planning an Audit Policy......Page 672
Auditing of Active Directory Access......Page 673
Filtering of Active Directory-Related Traffic......Page 675
What Time Is It?......Page 676
Identity Management......Page 677
Event Management Storage......Page 678
Data Access Points......Page 680
Host Operating Systems aka Servers......Page 681
Security Information Management......Page 682
Understanding System and Network Logs......Page 683
Which Logs are Relevant?......Page 685
Log Searching......Page 686
Dealing With Auditor™s Mistakes......Page 687
Planning for Remediation......Page 689
Know the Security Analysis Life Cycle......Page 694
Programmatic Testing......Page 695
Know the Core Processes......Page 696
Ethical Conduct......Page 697
The Penetration Methodology......Page 698
Forums and Blogs......Page 700
Vulnerability Exploitation......Page 701
Expansion of Reach......Page 702
Ensure Future Access......Page 703
The Cleanup......Page 704
What Is a Vulnerability Assessment?......Page 705
Why a Vulnerability Assessment?......Page 707
Host Assessments......Page 708
Automated Assessments......Page 709
Detecting Live Systems......Page 710
Enumerating Services......Page 711
Identifying Applications......Page 712
Two Approaches......Page 713
Administrative Approach......Page 714
The Hybrid Approach......Page 715
Realistic Expectations......Page 716
The Limitations of Automation......Page 717
Security Checklist......Page 718
Incident Response Plan......Page 719
Computer Incident Response Team......Page 720
Assess and Stabilize......Page 721
Forensics......Page 722
IT Recovery Tasks......Page 723
Training Is Not Optional......Page 724
Introduction to Auditing......Page 725
Understanding Vulnerability Assessments......Page 726
Creating an Incident Response Procedure......Page 727
Frequently Asked Questions......Page 728
B......Page 730
D......Page 731
G......Page 732
I......Page 733
M......Page 734
P......Page 735
S......Page 736
T......Page 738
X......Page 739
Z......Page 740