Citrix GoToAssist Service Desk Security

Transcription

1 Citrix GoToAssist Service Desk Security Robust end-to-end security measures have been built into the GoToAssist Service Desk architecture to ensure the privacy and integrity of all data.

2 2 Many service desk operations regularly deal with sensitive data, and support organizations and IT teams are rightly concerned with security. With the worldwide surge in privacy breaches, malware, viruses and denial-of-service attacks, it s important to scrutinize each and every IT solution to see that it is employing the most up-to-date and effective security measures available. This white paper outlines the measures that GoToAssist Service Desk utilizes to minimize security risks. Citrix considers the security of your information to be of the highest importance. Security is not an afterthought to functionality, but a key element that is designed and built into our systems from the ground up. Security encompasses all aspects of GoToAssist Service Desk, from the software to the facilities to the personnel developing and operating the service. Extensive measures have been undertaken to maintain the privacy and integrity of all data managed by GoToAssist Service Desk. This white paper describes some of those measures, including access controls, physical and operational security, data security and software development lifecycle security. Protecting the front door An essential element of information security is the reliable identification and authentication of those accessing the information. Every manner of application, data and network security could be applied to a system, but if we were not able to reliably identify those accessing the system, all our efforts toward security would be in vain. For this reason, GoToAssist Service Desk, as with all Citrix SaaS offerings, places great emphasis on user authentication. To begin with, all users must be registered using a valid account, which is associated with an identified organization. No guest or anonymous access to the system is permitted. In addition, numerous techniques are employed to detect and prevent unauthorized account access, such as complex password enforcement, soft and hard account lockout triggered by repeated unsuccessful log-in attempts and the logging and continuous monitoring of account probing and other anomalous behavior. Once a user is authenticated, continued access to the system is dependent upon the presence of a set of security tokens exchanged with the client during the authentication process. These tokens, or session identifiers, are protected using advanced web security mechanisms, including the use of cryptographically strong pseudo-random number generators and session hijacking/fixation countermeasures.

3 3 All access to GoToAssist Service Desk, whether pre- or post-authentication, is permitted only over connections that are secured with SSL/TLS. Any connection attempt that is not using SSL/TLS will be refused. Because of this security requirement, organizations and users can be confident that information passed between GoToAssist Service Desk and the user s browser or mobile app will be safe from would-be eavesdroppers and potential man-in-the-middle attacks that rely upon an initial HTTP (unsecured) connection. A secure foundation Although protecting the front door is essential, if the networks and systems that host a service are not themselves secure, the service may still be vulnerable. The successful penetration and compromise of the service can occur without passing through the front door at all. This, of course, is the reason that GoToAssist Service Desk is built upon a foundation of network, host and physical security. All web, application and database servers supporting Service Desk reside within highly secured worldwide datacenters. Physical access to these datacenters is actively monitored and restricted to authorized personnel only. The servers themselves are hardened to stringent Citrix standards and dedicated to running only those services required to support GoToAssist Service Desk. Citrix policy requires that all servers remain up to date with the latest security patches and undergo periodic reassessment through both internal and independent auditing and penetration testing. Network access to the systems hosting GoToAssist Service Desk is strictly controlled through firewalls and other network security devices designed to detect and respond to various attacks, including but not limited to denial-of-service (DoS) attacks originating from the Internet. Backend servers and services are never directly accessible to external systems or personnel. Furthermore, multiple levels of host and network security are employed to ensure that only authorized access is permitted between backend systems, effectively containing any potential internally leveraged attacks. Access to and activity on all systems is centrally logged and actively monitored for anomalous patterns or behavior. How safe is your data? Once your information has been entered into the GoToAssist Service Desk system, it is secured with multiple levels of access controls. Only those users explicitly granted access to your information may view or modify it. The design of the system requires that every access request pass through an authorization subsystem that verifies the access rights of the user before allowing the request to proceed. Unlike some data management systems, GoToAssist Service Desk does not include the concept of root access. This helps to ensure the privacy of your information, even against inadvertent or other internal exposure. Sensitive configuration information, passwords and keys are secured using the latest in cryptographic technology. Passwords are secured through a uniquely salted, one-way (irreversible) password hashing mechanism that ensures protection against exposure even to internal personnel with access to the storage systems and/or encryption keys.

4 4 Security by design In addition to the many security measures already described, GoToAssist Service Desk was built and continues to be developed using processes that guarantee the priority of security at every stage of the development lifecycle. At Citrix, every significant design and architectural decision must undergo a review process known as threat modeling, in which all foreseeable threats to the system are evaluated and measured in light of the proposed design/architectural features. Additionally, all code is required to be assessed for security flaws via static analysis, while all new and updated systems must be scanned and tested for security weaknesses using industry-leading manual and automated application vulnerability assessment tools. Finally, the entire deployed system is subject to continuous 24/7 vulnerability scanning and security analysis by an independent, industry-leading security firm. Our attention to secure product design is one of the reasons Citrix is the global market leader and one of the most-trusted names in IT support solutions. Citrix customers include 100 percent of the Fortune 100 and 99 percent of the Fortune Global 500, as well as hundreds of thousands of small businesses and individuals. Availability All the protection measures in the world will prove meaningless if you cannot access your information or systems when needed. Thus, one of the primary concerns with information security is availability. With GoToAssist Service Desk, the continued availability of your information is achieved in several ways. First, the Citrix datacenters that host your information incorporate system redundancy throughout in order to ensure resiliency in the face of outages due to failure or attack. Additionally, for the purposes of scalability and reliability, load balancers transparently distribute incoming requests among multiple Citrix servers. As mentioned above, security devices are also in place in every Citrix datacenter to implement countermeasures to denial-of-service (DoS) attacks. With regard to the prevention of unintended destruction or corruption of information, all Service Desk systems are backed up daily, and encrypted backups are securely replicated to multiple, geographically separated datacenters for disaster recovery purposes. Additionally, the Service Desk interface includes two independent protection mechanisms that require explicit user acknowledgement before executing any destructive requests and additionally provide for the recovery of inadvertently deleted data. Summary Security of data is more important than ever, and Citrix places a major focus on this across all levels of GoToAssist Service Desk. We have put in place a formidable array of security countermeasures so that our customers can use GoToAssist Service Desk with confidence.

5 5 Nevertheless, we recommend that you perform your own appropriate best-fit analysis to make sure our service meets your security requirements. We invite you to talk to a GoToAssist Service Desk representative today to discuss your needs and answer any questions you may have. North America Citrix Online, LLC 7414 Hollister Avenue Goleta, CA U.S.A. T info@citrixonline.com Europe, Middle East & Africa Citrix Online, UK Ltd Chalfont Park House Chalfont Park, Gerrards Cross Bucks SL9 0DZ United Kingdom T +44 (0) europe@citrixonline.com Asia Pacific Citrix Online, AUS Pty Ltd Level 3, 1 Julius Avenue Riverside Corporate Park North Ryde NSW 2113 Australia T asiapac@citrixonline.com About Citrix Citrix (NASDAQ:CTXS) is the cloud company that enables mobile workstyles empowering people to work and collaborate from anywhere, easily and securely. With market-leading solutions for mobility, desktop virtualization, cloud networking, cloud platforms, collaboration and data sharing, Citrix helps organizations achieve the speed and agility necessary to succeed in a mobile and dynamic world. Citrix products are in use at more than 260,000 organizations and by over 100 million users globally. Learn more at Citrix Online, LLC. All rights reserved. Citrix, GoToAssist, GoToMeeting, GoToMyPC, GoToTraining, GoToWebinar, OpenVoice, Podio and ShareFile are trademarks of Citrix Systems, Inc., or a subsidiary thereof, and are or may be registered in the U.S. Patent and Trademark Office and other countries. All other trademarks are the property of their respective owners /B-88414/PDF