Citrix XenMobile. Technical Overview

Transcription

1 Citrix XenMobile Technical Overview

2 Enterprise Mobility in Numbers BYO Devices Multiple Locations App Proliferation Unmanaged Data 3 Devices 65% Employees 200+ Apps 80%+ Fortune 500 Average per Employee Work in multiple locations Average Citrix customer portfolio Use unmanaged cloud storage Source: Citrix and leading analysts

3 Mobile devices enable work from more locations How often do you work from the following locations? 100% 80% 60% 40% 20% 90% 87% 87% 45% 35% (at least once a week) 33% 38% 26% Tablet Smartphone Laptop 28% 13% 17% 13% 0% Office Home Client site While traveling or commuting Base: 4,985 US information workers

4 37% of workforce will be mobile 15 Billion connected devices BY times more mobile projects than Windows projects

5 How Mobile Feels Today

6 User Needs Want access to all apps and data from any of their devices

7 For Enterprise IT, mobile presents big challenges

8 IT Needs to meet security and compliance requirements

9 But the needs of users and IT must be balanced

10 A complete stack for managing and securing apps, data, and devices App Management Data Management Device Management

11 Choice at Entry Choice at Entry (Device ownership type, Location, Posture) App and Desktop Virtualization Mobile App Management Mobile Device Management 11

12 Three Simple Packages XenMobile MDM Edition XenMobile App Edition XenMobile Enterprise Edition Provision security, apps & data to mobile devices Add advanced app & data management to any MDM solution Complete solution to manage apps, data & devices

13 MDM Edition Use case Client Side Server Side Mobile device management Jailbreak detection Selective or full wipe Geo location tracking Passcode enforcement Pushing applications Native mail client access control Wifi & vpn access control Access to sharepoint & network drives Worx Enroll Worx Home XenMobile Device Manager

14 MDM Edition Enroll XenMobile Device Manager Mobile Device Management D M Z

15 App Edition Use case Client Side Server Side Mobile application management Federated single sign on Secure Secure browsing Automated account provisioning Workflow Policy based interapp security App specific micro vpn Unified corporate app store Worx Home XenMobile App Controller NetScaler Gateway

16 App Edition Optional Worx VD Apps Netscaler XM App Controller SF XD / XA D M Z

17 Enterprise Edition Use case Client Side Server Side 17 All MDM Edition Use cases All App Edition Use cases Secure document sharing, syncing & editing Both cloud and on-premise data storage options Worx Enroll Worx Home Worx Mail Worx Web ShareFile SharePoint XenMobile Device Manager Access Gateway App Controller

18 Enterprise Edition XNC Native Mail Encryption Enroll XM DM XenMobile Device Management Optional Worx VD Apps Netscaler XM AppC SF XD / XA D M Z

19 MDM Edition App Edition Enterprise Edition Configure, secure & provision mobile devices One-click live chat & support Access SharePoint & network drives Secure mobile web browser Internet Secure mobile web browser intranet/enterprise Secure mail, calendar and contacts app Activate and manage Worx capabilities in apps Unified corporate app store Multi-factor single sign-on Secure document sharing, sync & editing Both cloud & on-premise data storage options

20 1 Secure and manage my devices My users are bringing in all types of devices I need to set PIN codes, WiFi, etc.. issuing shared tablets to shift workers in hospital/retail stores/restaurants/dist centers need to manage personal and corporate devices alongside each other Want to give device choice but what do I do if devices are lost or stolen? MDM Edition

21 1 Secure and manage my devices MDM Edition Enterprise-grade MDM: Manage & configure corporate and BYO devices Detect jailbreak, blacklist/whitelist apps Full/selective device wipe Easy to setup: Fully wizard-driven Extensible: Enterprise integration (e.g.: LDAP and PKI) Upgrade to Enterprise for mail or app mgmt any time

22 App Edition 2 Give me mail that users love and IT embraces Using Good, but the user experience stinks make my users lives better with that s beautiful, yet secure replacing BlackBerrys, but need similar policy controls for ios and Android devices provision an -specific PIN code

23 App Edition 2 Give me mail that users love and IT embraces Beautiful client, sandboxed for IT Native mobile mail, calendar, and contacts Attach and save data to ShareFile One touch access to internal sites with WorxWeb Calendar invites with GoToMeeting using free/busy Encrypted , attachments, contacts Available on iphone, ipad, Android Phone & Tablet

24 Secure XNC Native Mail Encryption Worx Netscaler XM AppC D M Z

25 3 Mobilize my apps and data give employees mobile access to our intranet and web apps need SSO for my field who use SalesForce/Evernote give users easy access to content on-the-go need to secure and manage custom and off-theshelf ios / Android apps Good Dynamics is too hard to implement App Edition extend my enterprise to partners and contractors.

26 App Edition 3 Mobilize my apps and data Secure to any ios/ Android device Secure intranet web browsing with micro VPN Enterprise ios/ Android app with MDX controls Integrated ShareFile data accessibility SAML Federation and AD based identity management Scenario-based access controls

27 Citrix The Most Complete Mobile Portfolio Any app, any device, anywhere Mobile VOI Mobile Device Management Sandboxed Mail and Web Mobile App Security SSO & Identity Management Secure Mobile Data Sharing Mobile Network Control Desktop & App Virtualization Social & Web Collaboration

28 Recognized as a Leader by Gartner; Winner at Interop Magic Quadrant Critical Capabilities Source: Gartner report, Magic Quadrant for Mobile Device Management Software, May 23, 2013, Phillip Redman, John Girard, Terrence Cosgrove, Monica Basso Source: Gartner report, Critical Capabilities for Mobile Device Management Software, May 23, 2013, Phillip Redman 2013 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. For more information, info@gartner.com or visit gartner.com. Used with permission.

29 XenMobile MDM Edition Mobile Device Management

30 What Policies are Companies Using? Citrix Enterprise Mobility Cloud Report 4Q12

31 XenMobile MDM Give users device choice whether corporate issued or BYO Manage the device throughout lifecycle

32 What You Need to Know The 6 Key Stages of the MDM Lifecycle Configure Provision Secure Support Monitor Decommission

33 Assess what devices you are going to support First do an assessment of what types of devices are connecting Exclude devices that lack features you require for compliance Dynamic dashboard for changing policy

34 Define User Groups Based on LDAP Quickly define policies by Active Directory group Automatically assign a user to a role such as Sales Provide up to date data when employees leave the company for timely decommissioning of devices

35 Jailbreak Detection Block jailbroken or rooted devices before enrollment to prevent security threats Ensure device and OS versions are compliant Devices can be monitored post-enrollment as well

36 Control Access to Corporate Mail IT Benefit: Protect company data and improved productivity End User Benefit: Access to corporate mail via native client Network Considerations: Leverage your NetScaler investment to control ActiveSync traffic from mobile devices Supports native ios client and Touchdown for Android

37 Enforce Passcodes Most commonly used policy by customers Multiple passcode policies ᵒ Complexity ᵒ Length ᵒ Auto-lock time ᵒ Maximum age Also strengthens device-level encryption for data-at-rest Strike a balance don t make passwords too complicated!

38 Enforce use of PKI and certificates Benefit for IT: Stronger user authentication Benefit for End User: Single Sign On for , WiFi & VPN EAS: Username/Password + Cert Step4: EAS: Username + Cert Step6: Sync Step1: MDM Connection NetScaler Step6: Retrieve Step5: Validate User Cert Step2: ZDM generates CSR based on template defined in CredentialProvider Exchange Server Network Considerations: XenMobile supports multiple PKI solutions: ᵒ Microsoft ᵒ RSA ᵒ OpenTrust ᵒ Entrust Devices Port 443 PKI Issued User Certificate XenMobile Device Manager PKI Issued User Certificate PKI Server Step3: CSR signed using CA public key

39 Control access to corporate WiFi & VPN IT Benefits: Allow only managed devices to access network for better security User Benefits: Reduce time to setup WiFi and VPN settings for employees (also reduces help desk calls) Network Considerations: Can leverage cert-based auth for WiFi & VPN

40 Push Apps to a Mobile Device How do you handle pushing business apps to all of your employees at once? IT Benefits: ᵒ Allow admins to remotely push and remove ios and Android apps to a mobile device to enhance productivity of employees ᵒ Convenient for mass distribution of corporate mobile apps User Benefit: ᵒ Access to corporate apps and data on their own device

41 Track device location IT Benefit: Geo-fencing rules to control use of devices and apps in specific locations User Benefit: Ability to track your own device in case it is lost or stolen Other Considerations: Can also track history of device s location over period of time

42 Selective Device Wipe IT Benefit: Removes corporate apps, mail and data in the event device is stolen, lost, non-compliant or if employee leaves company User Benefit: Leaves personal data intact What happens if a device is left behind at Starbucks? What if employees are downloading non-compliant apps? Other Considerations: Remote lock, automated actions and full wipe also available

43 Get Started with New XenMobile Device Manager Wizard

44 MDM Mobility Infrastructure Port 443 XNC Native Mail Encryption Enroll XM DM Mobile Device Management Worx Netscaler D M Z

45 Enroll XM-DM Active Directory Certificate Authority User enters their username, MDM server address and password The MDM server validates the user request and checks credentials with Active Directory The user credentials are validated at Active Directory The user is prompted to install the profile. Once installed, this configuration profile prompts the device to respond back to the server with specific device attributes A configuration profile is sent to the user s device. This configuration profile prompts the device for additional information The device generates a key and a certificate signing request using the SCEP protocol MDM server receives the device response and sends a second configuration profile with the SCEP payload to the device The device receives the certificate, generates a response back to the MDM server which is signed with the new certificate The certificate issuing service (SCEP enabled) receives the CSR from the device, verifies it, signs it and responds with the certificate for the device The MDM server then responds with an encrypted configuration profile containing the policies, settings, etc. The device receives the profile and automatically installs it

46 XenMobile Device Manager Actively manage policy and configuration for ios, Android, Windows Mobile/CE and Symbian Deploy and administer mobile applications ᵒ Functionality varies by app and platform Control data access with DLP add-on Receives connections directly from mobile devices Makes connections to: ᵒ Database Server (MS SQL Server or Postgres) ᵒ Directory Server (AD or any other LDAP based system)

47 XenMobile Device Manager Installation tips Installation is supported on 64bit Windows Server 2005, 2008 and 2008R2 ᵒ 2003 supported until EOL You will need an external DNS record and APNS cert Only install the recommended version of Java ᵒ Be sure to include the Unlimited Strength crypto jar files If you do not have MS SQL, the installer includes PostgresSQL for PoC s

48 XenMobile Device Manager Pre-requisites Windows Server (Standard or Enterprise) bit, bit, or 2008 R2 64 bit Service Accounts ᵒ Installation account must be local admin of server ᵒ Does not require SQL rights directly ᵒ Account with database creation permissions in SQL Intended MDM server does not need to be a member of the domain Do not install IIS. Uninstall IIS if it exists on this server External DNS record for the MDM server ᵒ (ex. Mobile.yourcompany.com) Apple APNS certificate ᵒ required during the install, obtained using the XenMobile APNS Certificate Setup Guide Java SE 7 Java Cryptography Extension (JCE) files Unlimited Strength Jurisdiction Policy Files ᵒ copy local_policy.jar and US_export_policy.jar to /Java/jdk1.6.0_x/jre/lib/security Software License

49 XenMobile Device Manager Directory Services Real-time access to LDAP (AD, Domino, etc..) source Can configure multiple connections to multiple servers Supports LDAP and LDAPS with certificate management Wizard driven configuration

50 XenMobile Device Manager Role Based Access Control Roles can be created as desired ᵒ For example, multiple helpdesk tiers, devices managed by business units, etc.. Access is granular by admin function or group Roles are selected by group ᵒ Groups can be defined locally or referenced from AD

51 SAM Account vs. User Principal Name (UPN) samaccount is used to support older OS Windows NT 4.0, Windows 95, Windows 98, and LAN Manager When configuring an LDAP connection, you can choose the User Search option of either samaccount Name or userprincipalname. Any user enrolling their device will need to know the format of their username see opposite By convention, UPN should map to the user name (Use This)

52 User Tips Remember: Users may belong to multiple groups and this can affect which packages are deployed Be sure to create at least 1 local account for emergency use ᵒ This account should not be in AD and be sure to protect this password. This may be your only way to log into the server if the AD connection is severed somehow. XenMobile Device Manager does not crawl the entire LDAP tree looking for users. Deeply buried user accounts may not be able to log in if the LDAP connection simply references the root.

53 Device Support Citrix XenMobile Device Manager allows you to manage the following mobile device platforms: Apple handheld devices (iphone, ipad) using ios 5.0 or higher Android handheld devices using 2.2 or higher Microsoft Windows 8 Phone and Windows 8 Tablet ᵒ Windows Mobile and its derivatives, including Smartphone and PocketPC ᵒ Windows Mobile 5.x or 6.x (PocketPC or Smartphone Edition) ᵒ Pocket PC 2003 ᵒ Windows CE 4.x, 5.x or 6.x BlackBerry handheld devices using BlackBerry OS versions 5.x, 6.x, and 7.x Symbian BB10

54 Device Functionality Matrix (1 of 4) Feature Mobile Windows 8 Windows 8 Phone Dashboard -- Enhanced Enrollment Modes (OTP, Multifactor, Invitationbased) Invitation Client Download Attachment Encryption App Lock ('Kiosk Mode') App Tunnels Mobile SSL VPN

55 Device Functionality Matrix (2 of 4) Feature Storage Card Encryption Policy Mobile Windows 8 Windows 8 Phone Auto discovery Logon Automated Actions -- Notifications Agent Notification Enterprise App Store Locate Device

56 Device Functionality Matrix (3 of 4) Feature Mobile Windows 8 Windows 8 Phone Geo-Tracking, Geo-Fencing Secure SharePoint Remote client installation (OTA) Provisioning of devices & users Hardware Inventory -- Software Inventory -- Security Jailbreak detection

57 Device Functionality Matrix (4 of 4) Feature Remote Wipe & Lock Mobile Windows 8 (limited) Windows 8 Phone Software download & install File transfer -- Device Remote Control Roaming Management Reports (activity & devices inventory) Local device data encryption (option)

58 How Citrix defines Policies Policies are all the individual elements of configuration or restriction available for definition Policies do not take effect unless deployed to a device In the event of a policy conflict, the more restrictive policy is applied

59 Policies Policies are all the individual elements of configuration or restriction available for definition Policies do not take effect unless deployed to a device In the event of a policy conflict, the more restrictive policy is applied MDM Policies Device specific configuration and restriction policies Application Tunnels Automated Actions Server Groups XenMobile Policies Application access policies (black/white lists) XM SDK enabled app control SharePoint configuration

60 Policy Tips Name policies with descriptive names ᵒ When browsing lists, the policy name is the only information you have to tell what the policy does ᵒ One common technique is to prefix the policy with the people who should receive it i.e.: Corp HQ Wi-Fi or Engineering Password Policy Remember that you can define as many policies as you like ᵒ Policies only take effect when they are deployed to a device Variables can be used to create more dynamic policies ᵒ For example, ${user.domainname}, ${user.userprincipalname}, etc. ᵒ A complete list is available at

61 Lock Screen Policies Common requirements (in order) 1. Have a passcode defined 2. Disallow simple passcodes 3. Set auto-lock time 4. Set maximum password age 5. Set maximum password length

62 Restriction Policies Can be very useful for Corporate Owned devices Not recommended for BYOD Common restrictions 1. Disable installation of apps 2. Disable camera 3. Disable icloud 4. Disable Google Play / App Store

63 Automated Actions Special policies which automatically triggers actions based on data All automated actions require devices to re-connect to the XenMobile Device Manager To trigger an automated action for a blacklisted application, the application to be blacklisted in Policies / Blacklist.

64 Example Automated Task Alerting a user when their access to access has been blocked. Choose the trigger type Choose the action, in this case we want to contact a user using a contact template Finally, choose your squelching parameters for the alert

65 Notification Template Notification templates are configured under the Options menu You will need to have a notification server defined for each type of notification you would like to send

66 Notification Templates, continued Remember to use template variables, they come in very handy here

67 Other Automated Actions Here are a few other automated actions Selective wipe when a device leaves geofence Warn users for any type of violation of their terms of use Set a out of compliance flag when a blacklisted app is installed ᵒ Subsequent deployments can be based on this flag, eg, remove wifi access when an app is installed Automatically revoke a jailbroken device

68 Deployments Deployment packages are used to push policies to devices Packages are comprised of: A package name Groups of users Resources which are a combination of A server group App tunnels Registry config. XML configurations Software inventory Applications Files Deployment schedule Deployment rules Zenprise Knowledge Base URL

69 Deployment Tips There are 2 schools of thought for deployment best practice Create multiple deployment packages with few policies ᵒ Benefits: Control user s policies and exceptions in a clear way Failed policies do not block other policies ᵒ Drawback: Many packages to create and manage Create few packages with many policies ᵒ Benefits: Control user s policies en masse Clear groupings of policies. (e.g., everyone in Asia gets Policy 1 2 and 4.) ᵒ Drawback: Failed policy blocks remaining policies in the package Exceptions require creating alternate packages

70 Location Services A location services policy must be pushed to a device in order to track the device or use the geofencing functionality Location services policies only apply to ios devices currently

71 XenMobile MDX Technologies MDX Technologies & Mobile Application Management

72 The Mobile App Management Fabric XNC Native Mail Encryption Enroll XM DM Mobile Device Management Worx SF VD Apps Netscaler XM AppC XD / XA D M Z

73 Management, security, and control over native mobile and web apps

74 MDX Technologies Encrypted local storage App App App Micro (app specific) VPN App specific lock and wipe Inter-app communication Conditional access policies App Preparation Tool Federated identity and SSO

75 App deployment securing apps with MDX 1. Download apps from 2. Prepare apps with MDX Toolkit.ipa or.apk App Preparation Tool.mdx

76 WorxHome SSO to all MDX apps User support for MDX apps WorxMail Integrated , contacts and calendar Designed for work WorxWeb Internet and intranet browsing Supports file download ShareFile All your files available anywhere Sharing integrated into other MDX apps

77 WorxHome Apple App Store Google Play WorxMail WorxWeb XenMobile Worx ShareFile

78 System Overview ShareFile Worx NetScaler Access Gateway App Controller Device Manager StorageZone Control Plane XenMobile Enterprise

79 MDX Architecture Managed apps Secure Network Tunnel Secure IPC gateway services app app one two MDX Framework MDX Framework MDX Framework logon policies app private data vault app private data vault app private data vault Worx Home XenMobile shared data vault vault encryption MDX Framework provided by either: 1. Wrapping toolset 2. Directly compiled SDK

80 MDX Fundamentals API interception mobile app network files clipboard policy aware network interception files functions clipboard API Interception techniques Direct modification of app binaries ᵒ Redirect system services to proxy objects/methods ᵒ Extend app lifecycle classes (Android) Run-time augmentation ᵒ Objective-C class extension w/method swizzling (ios) ᵒ Runtime API interception for system calls & native libraries mobile OS micro-vpn encrypted storage encrypted clipboard Citrix mobile services

81 Core MDX Framework Authentication and SSO App access controls Information containment Secure inter-app communication App behavior controls File and database encryption Micro-VPN (app specific tunnels).mdx

82 Authentication Authentication and SSO WorxHome Strongly authenticates users ᵒ NetScaler Gateway is primary authentication point ᵒ Permits combinations of AD credentials with certificates, tokens, and other second factors Registers devices to users ᵒ Permits lock and wipe of corporate data/apps on selected devices Serves as access manager for MDX managed apps ᵒ Strongly identifies managed apps ᵒ Determines app entitlements and policies for authenticated users ᵒ Brokers permitted data exchanges between managed apps

83 Single sign-on Authentication and SSO WorxHome SSO for all managed apps ᵒ Hosted HDX apps and desktops ᵒ Web/SaaS apps ᵒ MDX managed mobile apps Various online and offline modes selected by app policy MDX apps can use derived credentials ᵒ Gateway tickets for micro-vpn access ᵒ Automatic HTTP auth challenge responses (NTLM today, Kerberos coming soon) ᵒ Certificates for PKI protected web sites ᵒ Specialty credentials eg (SAML token for Sharefile access)

84 App Access Controls Block/permit app access based on policy User authentication (how and when) ᵒ Online versus offline, re-authentication period, max offline time Device security posture ᵒ Jail-broken or rooted ᵒ PIN/passcode enabled ᵒ Hardware enforced encryption ᵒ MDM enrolled vs unmanaged Network state ᵒ Internal network or external ᵒ Specific internal wifi networks ᵒ Wifi Only

85 Information Containment What happens in MDX apps stays in MDX apps. Control data exchange with other apps and devices: ᵒ Cut/Copy/Paste ᵒ Document exchange (Open-In) ᵒ Inter-app communications ᵒ Network APIs Quick Look Facebook Mail Box Evernote OfficeHD Quick Look OfficeHD without containment with containment

86 Secure inter-app communication app one Open-In app two Restricted Allow only trusted apps to share data with one another Unrestricted No controls, Open In shows all apps registered to handle that file type Blocked No way to share that app s data with anything else mobile OS

87 App Behavior Restrictions Block mobile OS API sets and features ᵒ Printing ᵒ icloud ᵒ and SMS compose ᵒ Inter-app URL dispatch and scheme handlers (ios) ᵒ Intent launch and content providers (Android) Block access to sensitive device hardware ᵒ Camera, microphone, location services, etc. All controls are applied at run-time based on app policies

88 Data security on mobile platforms The Problem Mobile platforms secure persistent data in app sandboxes ᵒ Trivially defeated by jail-breaking or rooting device Mobile platforms can encrypt persistent data but there are limits ᵒ Encryption keys are held persistently on device ᵒ Keys are often protected by cryptographically weak PIN or passcode ᵒ No means to destroy keys or revoke access if device is not recovered The Solution ᵒ Encrypt app data only not the entire device ᵒ Enterprise sets the key management rules on an app-by-app basis

89 File and Database Encryption MDX framework intercepts/redirects file and database I/O transparently ᵒ Apply AES 256 encryption (FIPS 140-2) algorithms on-the-fly ᵒ No need to rewrite apps Two key management modes: ᵒ Online only - Keys held in XenMobile key management service (server-side) Must have network access to authenticate user and recover keys when needed Keys are never persisted on device ᵒ Offline - Keys maintained by Worx Home Persisted locally, recoverable after local user auth

90 Micro-VPN Network Access policies: ᵒ Blocked: App network APIs are blocked and fail as if network is not available ᵒ Unconstrained: App network APIs work normally ᵒ Tunneled: App network APIs are tunneled through NetScaler Gateway to enterprise intranet Relies on Worx Home for authentication and SSO Tunneled setting enables Micro-VPN features ᵒ Full power of NetScaler Gateway 10.x to configure VPN behavior ᵒ Split-tunnel based on IP address ranges or domain suffix, or route all traffic back to intranet ᵒ Automatically respond to HTTP auth challenges on behalf of app ᵒ Powerful rules engine for constraining access for external apps

91 Micro-VPN Architecture (ios) mobile app Networking Logic NSURLReques t CFNetwork BSD Sockets NSURLReques t Network interception functions direct calls (resolve domain, etc.) corporate intranet server ASIHTTPRequest proxy info Tunneler library Socks Proxy UDP Proxy TCP Proxy session ticket auth localhost listener server MDX Framework network requests (redirected to local proxy) encrypted tunnel

92 Worx Worx-enable any mobile app Public distribution with MDX controls Apple App Store Google Play MDXSDK/FunctionRename.h

93

94

95 Worx App Gallery Where IT finds Worx-enabled mobile apps

96 Using Worx Apps Apple App Store Google Play MDX file (app and policy metadata) delivered from Worx App Gallery App binaries sourced from public app.ipa.apk stores ISVs can deliver these apps as either ᵒ A new app designed specifically for XenMobile ᵒ A general app store app that can activate the MDX framework/policies dynamically user s device XenMobile.mdx Worx App Gallery

97 Citrix Mobile App Management Full support for both personal and corporate usage (BYOD) ᵒ Corporate apps and data secure even on employee-owned devices ᵒ New consumer-driven devices supported immediately No risk of corporate data loss or compliance exceptions when: ᵒ Device is lost or stolen or employee leaves organization ᵒ Collaboration / file sharing apps used on the device Governance is built-in ᵒ Policies can be updated on hundreds of apps with no requirement to change source code No requirement for developers to change the way they develop apps or learn mobile security standards

98 MDX App Vault MDX Access MDX InterApp Secure container that enables app and data containment, wipe and lock Micro-VPN tunnel to corporate resources from mobile apps along with access control policies Control inter-app communications with external apps, cloud, clipboard & devices

99 MDXVault Native Mobile Apps Deny SMS Disable icloud Disable screenshots Force authentication Block jailbroken device MDX Policies during app wrapping MDX InterApp Citrix Receiver app private data vault app private data vault private data XenMobile

100 MDXInterapp MDX InterApp Citrix Receiver Open with Deny access to in-secure applications private data XenMobile

101 MDXAccess MDX InterApp Citrix Receiver private data

102 MDXAccess MDX InterApp Citrix Receiver SSL SSL SSL SSL SSL SSL SSL SSL SaaS Web Mobile Data private data Access Gateway C-VPN Mode XenMobile

103

104

105

106

107

108 Secure app containers Micro VPN App specific lock and wipe Inter-app communication Conditional access policies Federated identity and SSO

109 Sandboxed and browser Mail, calendar, contacts Enterprise class security Beautiful native-like experience Secure mobile browser Internal web app access URL black/whitelists

110 WorxMail Mail, calendar, contacts Enterprise class security Beautiful native experience Full inter-app integration MDX-secured Secure body and attachment Open in control to provide data leak protection No Exchange server exposure to internet Send with ShareFile attachments Integrated calendars and Exchange GAL

111 Sandboxed , calendar and contacts app Secure app with great user experience Attach files to s and save attachments Full calendar with access to free/busy Directly open web links to any site, including intranet sites

112 Secure document sharing, sync & editing Both cloud and on-premise data storage options Capable of accessing SharePoint and network drives Open-in capabilities can be restricted to other Worx-enabled apps

113 WorxMail- Topology Internet 1. WorxMail resolves internal-fqdn 2. Traffic is tunneled inside micro VPN (SSL Session) 3. NetScaler traffic, forward to exchange server NetScaler/ Client Access Server (CAS) Access Gateway

114 WorxWeb Secure browser Internal web app access Full inter-app integration Consumer experience MDX-secured ios and Android device intranet web browsing Easy accesst to SharePoint, Intranet Portal etc Similar look/ feel as native browser Safari on ios; Chrome on Android Single sign-on via NetScaler Respond to HTTP

115 Secure mobile web browser Full-featured consumer-like browser Secure access to internal, external and HTML5 web apps URL whitelisting and blacklisting Access to enterprise resources with a Micro VPN

116 WorxWeb- Topology Internet 1. WorxWeb does HTTP GET/Post to internal-fqdn 2. Traffic is tunneled inside micro VPN (SSL session) 3. NetScaler upwraps WorxWeb traffic, communicates with internal web server 4. Enterprise web proxy could be NetScaler s next-hop, for internet bound traffic (Split-tunnel is OFF) 5. Split-tunnel ON sends internet traffic bypassing the enterprise NetScaler/ Access Gateway

117 Citrix Enroll, Worx Home and Receiver

118 Unified corporate app store Available on 3B+ devices Mobile apps native on device Seamless delivery of Windows, datacenter and web apps Any device smartphone, tablet, PC and Mac

119 Multi-factor single sign-on Two-factor authentication for app and data access SSO for Windows, web, datacenter & mobile apps

120 Enroll Worx Home Receiver Platform - ios Purpose Enroll your ios device Platforms - ios and Android Purpose Unified single-client experience for Mobile MDX, Windows HDX and SaaS apps MDM-Mode or MAM- Only mode Platforms Win, Mac, ios, Android, Web Purpose Windows HDX Experience Used with Worx Home for HDX ICA handling 120

121 What is Worx Enroll MDM client Registers the device into the MDM system Push: ᵒ Mobile applications ᵒ Web and SaaS links ᵒ HDX links ᵒ Profiles ᵒ Certificates

122

123

124

125

126

127

128

129 What is Worx Home? Central authentication engine providing Single Sign-On Contains the MDM configuration engine Contains the MDX engine

130 Use address or server URL to configure Worx Home URL is the NetScaler Gateway or XenMobile App Controller server address

131 Once the server is found, the user is prompted for: Username Password Optional 2-factor

132 Worx Home screen Shows all the applications installed on the device which includes mobile, Web/SaaS, and Windows (XenApp/XenDesktop) apps

133 Single store for Web/SaaS, mobile apps, and HDX applications are available Allows custom company branding with the company logos as well as background selections

134 Downloading an ios mobile application wrapped in MDX technology, prompts for installation, as with any other native application

135 This store allows the installation of mobile, web/saas links, and HDX applications

136 Applications shown in the native ios springboard and within the My Apps screen of Worx Home

137 Swiping to the right or left brings you to the Support Page. This page is not only for Worx Home but any IT issue. All versions of the XenMobile come with a seat of GoToAssist Three support options: Phone Chat

138 Phone support: Tablet Phone number is displayed Smartphone - Phone number is automatically dialed

139 GoToAssist Chat Chat support: Chat with a support desk staff on issue Log file automatically sent to chat support Pictures can be sent from the photo catalog If support staff not available, the chat will prompt to open a support ticket

140 A support ticket to GoToAssist or any IT Support address can be initiated Includes the log files from Worx Home

141 based Auto-discovery for Receiver If work is entered, Receiver extracts domain suffix e.g. domain.com and query DNS for SRV record If no DNS record is found, alternatives are: ᵒ Enter server address of AG or StoreFront e.g. or ᵒ Run the provisioning file generated by StoreFront

142 Simple store discovery Resolve domain Identify AG FQDN Hit AG Prompt for authn DNS Discover Stores StoreFront #CitrixSynergy #SYN203

143 HDX applications? Authenticate to Worx Home will single Sign On to Receiver User adds from Company app store User can launch HDX app from the My Apps within Worx or if using MDM a link can be added to the ios springboard

144 MDM only => Worx Enroll + Worx Home MDX only => Worx Home MDM + MDX => Worx Enroll + Worx Home MDM + MDX + HDX => Worx Enroll + Worx Home + Receiver MDX + HDX => Worx Home + Receiver HDX only => Receiver

145 XenMobile App Controller

146 App Controller Features ios and Android device security controls Secure to any ios/ Android device Secure intranet web browsing with micro VPN Enterprise ios/ Android app with policy controls Device status, remote lock, wipe and recovery Integrated Data accessibility SAML Federation and AD based identity management

147 AppController Standalone XNC Native Mail Encryption Enroll XM DM Mobile Device Management Worx Netscaler XM AppC D M Z

148 Integrate with XA/XD StoreFront Only XNC Native Mail Encryption Enroll XM DM Mobile Device Management Worx SF VD Apps Netscaler XM AppC XD / XA D M Z

149 Integrate with XA/XD Web Interface Only XNC Native Mail Encryption Enroll XM DM Mobile Device Management Worx VD Apps Netscaler XM AppC XD / XA D M Z WI

150 Web & SaaS Apps Internet Zone 80/443 (App Specific) FIREWALL DMZ Zone FIREWALL Corporate LAN Zone DNS 53 NTP 123 DNS & NTP 80/443 (App Specific) / Netscaler NSIP SNIP for downloads DNS 53 NTP / /443 80/443 Goole Play Store Apple App Store ios only & for Form-Fill auth AG VIP XNC LB VIP /443 / 8443 XM DM 389/636 App Controller Active Directory Exchange StorageZone Controller MS CS SQL StoreFront XA/XD CIFS SharePoint

151 App Controller Connection Modes Supports for direct mode access to Web/SaaS resources Supports integration with Citrix StoreFront/WI on Windows Supports remote access via NetScaler Gateway Supports Citrix Update Services Supports Account Services By default, App Controller mode is enabled for direct access of Web/SaaS/Mobile/Docs resources StoreFront mode is to integrate App Controller with XenApp & XenDesktop For remote access to Web/SaaS/Mobile/Docs resources from App Controller, select NetScaler Gateway

152 Federated Single Sign-on Active Directory App Controller Web/SaaS Administration Define Roles Roles map to AD groups Extracts memberof attribute MAP Configure Applications Connectors for federated access or user accounts Long list of built-in connectors Wizards for custom federated access

153 Workflow and Provisioning Engine Role-based User Account Management Master Employee List Active Directory Sync 1. Standard enterprise provisioning systems create user accounts on AD 2. Sync to identify user-group association 3. Create user accounts with associated privileges on external applications If user is disabled on AD, all external accounts can be disabled too App Controller

154 Role-based User Account Management

155 Automatic Account Provisioning Auth Active Directory Sync App Controller Log Reporting Systems Create Users What privilege on application? Any app specific security rules? Additional approvals required before creating account?

156 Automatic Account Provisioning

157 Workflow and Provisioning Engine Workflow Management User self-service application request 2. Request triggers AppC workflows 3. Approvers get mail notifications and approve request 4. Application account gets provisioned for user Approver Approver 3 App Controller 4 Approver

158 Workflows

159 Scenario-based controls

160 Certificate Management App Controller hosts: ᵒ Server Certificate ᵒ SAML Certificate ᵒ Intermediate and Root CA Certificates Only one Server Certificate can be active Only one SAML Certificate can be active

161 Device Registration First time logon: lightweight mobile device registration Worx Home silently registers device with App Controller ᵒ Worx Home provides device unique token and selected device information App Controller issues unique device ID Worx Home App Controller links device ID/tokens to users ᵒ Admins can view all devices registered to users ᵒ Devices can be locked or marked for app data wipe ᵒ Worx Home and MDX apps poll App Controller current lock/wipe status

162 Device Registration

163 User authentication and roles Worx Home is the primary authenticator of users seeking access to enterprise resources for ᵒ Managed mobile applications for Android and ios ᵒ SaaS/Web applications ᵒ Hosted apps (ICA/HDX) App Controller roles are always linked to Active Directory users and groups ᵒ Users are entitled to specific apps through the roles they belong to ᵒ Deep AD integration allows for automatic provision/de-provision of SaaS accounts when AD users are removed or added

164 Device and app authentication Worx Home registers and track devices to users ᵒ Permits lock and wipe of corporate data/apps on selected devices Worx Home also serves as access manager for MDX managed applications ᵒ Strongly identifies applications ᵒ Determine app entitlements and policies ᵒ Brokers permitted data exchanges between managed apps MDX applications can parlay their Worx Home auth context into other credentials for single-sign ᵒ NTLM challenge/response (or the real AD domain, username, & password) ᵒ User and device certificates ᵒ Specialty tokens like Sharefile SAML token eventually kerberos, Oauth/OpenID, etc.

165 Single sign-on Worx Home and App Controller directly provide SSO for ᵒ Hosted applications (ICA/HDX) ᵒ Web/SaaS applications MDX applications can parlay their Worx Home authentication context into other credentials and access rights ᵒ Gateway tickets for micro-vpn access ᵒ NTLM challenge/response (or even the real AD domain, username, & password) ᵒ User and device certificates ᵒ Specialty tokens like Sharefile SAML token ᵒ Eventually credentials for auth systems kerberos tokens, Oauth/OpenID, etc.

166 Dashboard

167 Apps & Docs

168 Deployment Modes

169 Integration with XenMobile Device Manager

170 Integration with GTA

171 Branding Your Store

172 Release Management

173 Receiver Template

174 Google Play Store Apps

175 ShareFile & Follow-Me-Data

176 Users Demand Instant file and data access from any device File sharing (with anyone) Easy and familiar (love Dropbox) IT Wants Security Control no data leakage (hate Dropbox)

177 ShareFile Enterprise Empower users with Instant access to data, synced across all devices Improve collaboration and productivity through secure file sharing Meet corporate security and compliance standards with a secure service Deliver an enterprise-class service that meets workflow and productivity needs Enable IT to retain control and deliver a managed service Access data wherever it s stored, on/of premise, and existing data platforms

178 Workflow Integration with Microsoft Outlook Unclog mail servers Attachment conversion Overcome file size restrictions Better control and visibility Request large files

179 Plug-ins for Windows Explorer and Mac Finder Integration that provide an intuitive user experience

180 Team Folders - File Distribution to Any Device Latest file versions pushed to user devices Restrict access to download only

181 ShareFile Enables Mobile Workstyles Mobile Device Support Mobile Site iphone Android BlackBerry Windows 7 Phone ipad Android Tablet Native apps for iphone, ipad, Android phone, Android tablet, Windows phone Mobile-optimized ShareFile web site Secure online or offline access and sharing

182 Built-in Mobile Content Editor Automatically sync folder contents for offline editing Offline editing of Microsoft Word, Excel and PowerPoint documents Mark up PDF documents with text, arrows, shapes and drawings Restrict use of unauthorized content editing tools

183 Folder sync to mobile devices Automatically sync folder contents for offline viewing/editing Sync occurs only over Wi-Fi by default

184 PDF Annotation on mobile devices Mark up PDF documents with text, arrows, shapes and drawings

185

186 ShareFile with StorageZones Choose where your data is stored

187 ShareFile with StorageZones Choose where your data is stored Cloud Citrix-managed StorageZones On-Prem Customer-managed StorageZones Existing File storage Existing network shares and ECM systems

188 Why StorageZones? Compliance Performance Legal compliance with geographic storage requirements Alignment with organizational policies Files and folders in closer proximity to users File access performance optimization

189 ShareFile with StorageZones Citrix-managed StorageZone Customer-managed StorageZone (example)

190 ShareFile folder structure 190

191 Citrix- Managed StorageZones Control Plane Client *.sharefile.com DB Sharefile.eu. Web Application Reporting Windows phone Authorization Storage Center (EC2) S3 StorageZones Storage centers Backend storage Various locations WW

192 Customer- Managed StorageZones Control Plane Client *.sharefile.com DB Sharefile.eu Web Application Reporting Windows phone Client Authorization Storage Center (EC2) Storage Center (Windows IIS) S3 NAS NAS StorageZones Storage centers Backend storage Various locations WW Customer Datacenter

193 ShareFile StorageZone Connectors ShareFile Personal Folder ShareFile Team Folder ShareFile Team Folder Existing Network Share SharePoint Doc Library Corp Governance SharePoint Library 193

194 Optimized for Virtual Desktops + On-Demand Sync Instant access, share and sync Reduce storage costs

195 ShareFile and XenMobile Integration Use ShareFile as the underlying data platform Containerize enterprise data Store, sync, share, edit documents Intelligent interoperability between MDX apps Containerized Data MDX Wrapped Apps Intelligent Interoperability 195

196 Receiver Docs Tab Retirement ShareFile had been integrated into Receiver via Docs tab Replaced by MDX-Enabled ShareFile mobile app 196

197

198

199 Citrix XenMobile & ShareFile Advanced Authentication & Provisioning XenApp Integration Data protection Encrypt, Lock & Wipe Policy-based Control Offline Access and 2 way Synchronization Single Sign On AD / Role based provisioning 199

200 Security Information SSAE 16 audited data centers SSL Encryption in transit AES 256-bit encryption at rest All uploaded files scanned for viruses Daily scans for McAfee SECURE accreditation All ShareFile servers protected by dedicated firewalls

201 Enterprise Active Directory Options SAML 2.0 Support Requires customer provided and configured SAML provider Microsoft ADFS Support Also supports popular Identity Providers such as: ᵒ ᵒ ᵒ ᵒ OneLogin CA SiteMinder PingIdentity PingFederate SalesForce Selective data wipe Instant user provisioning and deprovisioning Real-time SaaS application monitoring Comprehensive access control policies Unified storefront for all applications, data and services

202 XenMobile and NetScaler

203 Ingredients of a Gateway Administrator Maximum Security Ease of Administration Integration with App Delivery Long Term Investment End User Interested in Apps, not Gateway Single Sign On to everything Seamless Access

204 NetScaler Gateway Product Line Consolidation Access Gateway Standard Edition Access Gateway Advanced Edition Access Gateway Enterprise Edition NetScaler Gateway

205 What does this mean? Focused development on a single Gateway platform Based on High Performance, High Scalability, NetScaler Platform One Gateway across all Citrix Solutions Straight-forward upgrade to NetScaler One Gateway Any Citrix Deployment Based on NetScaler

206 Traditional Gateways IPSec / SSL VPN access Full Device level access Require complex controls on the Gateway, to secure legitimate traffic Multiple logons Focused on Network connectivity not application access

207 NetScaler Gateway (ICAProxy / MDX) Secure by Design Simple wizard driven setup Designed to be the best Secure Remote access to Citrix App Delivery infrastructure One Gateway for ᵒ Virtual App/Desktop delivery ᵒ Web and SaaS resources ᵒ Native Mobile app delivery Receivers provide apps (manage remote access transparently) Single Sign on to everything

208 Business Apps Productivity and Collaboration Secure Mail Data Management Device Management XenMobile MDM and NetScaler AppMgmt Providing Security and Performance NetScaler

209 Front-end Security How? NetScaler provides High Availability, Security with built in Scalability Why? Provide complete security against external threats scalable to over 100,000 concurrently connected users XenMobile Device Managers (XDMs) Citrix 209

210 How? Access Policy Controls with NetScaler and XNC With tight XenMobile integration, NetScaler filter access to Microsoft Exchange based on DeviceID Why? Protects In-line Exchange ActiveSync access against unauthorized Allow Secured Mobile devices and/or compromised access to the enterprise mail servers, with seamless blacklist/ whitelist control Block Jailbroken devices Help corporate compliance XenMobile MDM w/ XenMobile NetScaler Connector (XNC)

211 Enterprise Storage Zones allows organizations to leverage hybrid storage solutions

212 Citrix NetScaler Provides Secure-Access and High Availability to On-Premise Cloud Storage

213 Scalable and Secure Access to Mobile Applications How? Full SSL VPN tunnel with NetScaler Gateway and MicroVPN for app-level policy controlled tunneling for mobile apps and browse Why? Policy-driven access to corporate resources are essential especially in BYOD XenMobile MDM AppController

214 Content Switching Load Balancing App Templates AppFlow AG -Smart Access -SSL VPN GSLB XNC AppCache App Firewall -Application Security User Performanc Monitor NetScaler Platform Functional Modules AppCompress NetScaler Application Delivery Networking Platform

215 Content Switching Load Balancing App Templates AppFlow NS Gateway -Smart Access -SSL VPN GSLB XNC AppCache App Firewall -Application Security User Performance Monitor AppCompress NetScaler Gateway = Mobile Secure Access NetScaler Application Delivery Networking Platform

216 Content Switching Load Balancing App Templates AppFlow AG -Smart Access -SSL VPN GSLB XNC AppCache App Firewall -Application Security User Performance Monitor NetScaler Standard Edition Functional Modules AppCompress NetScaler Application Delivery Networking Platform

217 Content Switching Load Balancing App Templates AppFlow AG -Smart Access -SSL VPN GSLB XNC AppCache* App Firewall -Application Security User Performance Monitor NetScaler Enterprise Edition Functional Modules AppCompress NetScaler Application Delivery Networking Platform Note: AppCache is an option in EE; GSLB option in SE

218 Content Switching Load Balancing App Templates AppFlow AG -Smart Access -SSL VPN GSLB XNC AppCache App Firewall -Application Security User Performance Monitor NetScaler Platinum Edition Functional Modules AppCompress NetScaler Application Delivery Networking Platform Note: HDX Insight historical data in PE

219 Different Approaches to (all available with Mobile Solutions Bundle) Customer Wants to Use Native ios Client Use XenMobile NetScaler Connector Solution Customer Wants to Use Touchdown Client on Android Use XenMobile NetScaler Connector Solution Customer Wants to Client Use Access Gateway Solution (MicroVPNs)

220 NetScaler VPX-10 NetScaler Gateway MPX Mbps / 5000 CCUs MPX 5550 / Gbps NetScaler VPX-100 / 1000 MPX 8200 / Gbps SDX 8200 / Instances MPX Gbps FIPS Compliant MPX Gbps SDX Instances MPX Gbps SDX Instances Lab Small/Medium Business (1-5 Apps) Enterprise (10s of Apps) Internet-centric (100s of Apps) Service Provider / Telco / Cloud (Multi-tenancy)

221 Access Gateway

222 Citrix Access Gateway is the only secure application and desktop access solution that provides administrators with application-level control while empowering users with access from anywhere. Secure Single Signon to StoreFront Services Ticket-based Connection Authorization VPN-less Remote Access from Any Device Endpoint Analysis & SmartAccess

223 Introducing Access Gateway Trusted Single Sign-on Access Gateway and StoreFront Services verify the existence of each other to ensure credentials are passed from a trusted source Secure Ticketing Connections are authorized using a secure single-use ticket. This prevents man-in-themiddle as well as replay attacks Anywhere Access Allows users to securely access desktops and applications using any device in any Application, including home computers and mobile devices SmartAccess Endpoint analysis and session policy controls allow for server-side filtering of resource lists are passed from a trusted source Network Access Allows users to access network resources using a traditional SSL VPN with strict authorization policies and split tunneling controls VPN-less Access Enables secure remote access to critical web applications from users browsers without requiring additional client components

224 Access Gateway Wizard