Security and user experience 编辑

Security is important to any organization, but you need to achieve a balance between security and user experience. For example, you might have a highly secured environment that is difficult for users to use. Or, your environment might be so user-friendly that access control is not as strict. The other sections in this virtual handbook cover security features in detail. The purpose of this article is to give a general overview of common security concerns and the security options available in Endpoint Management.

Here are some key considerations to keep in mind for each use case:

• Do you want to secure certain apps, the entire device, or both?
• How do you want your users to authenticate their identity? Do you want to use LDAP, certificate-based authentication, or a combination of the two?
• How long do you want a user’s session to last before it times out? Keep in mind that there are different time-out values for background services, Citrix ADC, and for being able to access apps while offline.
• Do you want users to set up a device-level passcode and an app-level passcode? How many logon attempts do you want to allow? Keep in mind the additional per-app authentication requirements that might be implemented with MAM and how users might perceive them.
• What other restrictions do you want to place on users? Do you want to give users access to cloud services such as Siri? What can they do with each app you make available to them and what can they not do? Do you want to deploy corporate network (Wi-Fi) policies to prevent cellular data plans from being used from inside the office?

App vs. Device

One of the first things to consider is whether you want to secure:

• Only certain apps (mobile app management, or MAM)
• The entire device (mobile device management, or MDM).
• MDM+MAM

Most commonly, if you don’t require device-level control, you only need to manage mobile apps, especially if your organization supports Bring Your Own Device (BYOD).

Users with devices that Endpoint Management doesn’t manage can install apps through the app store. Instead of device-level controls, such as selective or full wipe, you control access to the apps through app policies. Depending on the values you set, the policies require the device to check Endpoint Management periodically to confirm that the apps are still allowed to run.

MDM allows you to secure an entire device, including the ability to take inventory of all the software on a device. MDM allows you to prevent enrollment if the device is jailbroken, rooted, or has unsafe software installed. Taking this level of control, however, makes users leery of allowing that much power over their personal devices and can reduce enrollment rates.

Authentication

Authentication is where a great deal of the user experience takes place. If your organization is already running Active Directory, using Active Directory is the simplest way to have your users access the system.

Another significant part of the authentication user experience is time-outs. A high security environment might have users sign on every time they access the system. That option might not be ideal for all organizations or use cases.

User Entropy

For added security, you can enable a feature called user entropy. Citrix Secure Hub and some other apps often share common data like passwords, PINs, and certificates to ensure everything functions properly. This information is stored in a generic vault within Secure Hub. If you enable user entropy through the Encrypt Secrets option, Endpoint Management creates a vault called UserEntropy. Endpoint Management moves the information from the generic vault into this new vault. For Secure Hub or another app to access the data, users must enter a password or PIN.

Enabling user entropy adds another layer of authentication in several places. As a result, whenever an app requires access to shared data in the UserEntropy vault (including passwords, PINs, and certificates), users must authenticate.

You can learn more about user entropy by reading About the MDX Toolkit. To turn on user entropy, you can find the related settings in the Client properties.

Policies

Both MDX and MDM policies give a great deal of flexibility to organizations, but they can also restrict users. You might want that restriction in some situations, but policies can also make a system unusable. For instance, you might want to block access to cloud applications such as Siri or iCloud that have the potential to send sensitive data to outside locations. You can set up a policy to block access to these services, but keep in mind that such a policy can have unintended consequences. For example, the iOS keyboard mic relies on cloud access.

Apps

Enterprise Mobility Management (EMM) segments into Mobile Device Management (MDM) and Mobile Application Management (MAM). While MDM enables organizations to secure and control mobile devices, MAM facilitates application delivery and management. With the increasing adoption of BYOD, you can typically implement a MAM solution, such as Endpoint Management, to assist with the following:

• app delivery
• software licensing
• configuration
• app life cycle management

With Endpoint Management, you can add more security to these apps by configuring specific MAM policies and VPN settings to prevent data leaks and other security threats. Endpoint Management provides organizations with the flexibility to include both MDM and MAM functionality in the same environment.

In addition to the ability to deliver apps to mobile devices, Endpoint Management offers app containerization through MDX technology. MDX secures apps through encryption that is separate from device level encryption provided by the platform. You can wipe or lock apps. Apps are subject to granular policy-based controls. Independent software vendors (ISVs) can apply these controls using the Mobile Apps SDK.

In a corporate environment, users use various mobile apps to aid in their job role. The apps can include apps from the public app store, in-house developed apps, or native apps. Endpoint Management categorizes these apps as follows:

Public apps: These apps include free or paid apps available in a public app store, such as the Apple App Store or Google Play. Vendors outside of the organization often make their apps available in public app stores. This option lets their customers download the apps directly from the Internet. You might use numerous public apps in your organization depending on users’ needs. Examples of such apps include GoToMeeting, Salesforce, and EpicCare apps.

Citrix does not support downloading app binaries directly from public app stores, then wrapping them with the MDX Toolkit for enterprise distribution. To MDX-enable third-party applications, contact your app vendor to obtain the app binaries. You can wrap the binaries by using the MDX Toolkit or integrate the MAM SDK with the binaries.

In-house apps: Many organizations have in-house developers who create apps that provide specific functionality and are independently developed and distributed within the organization. In certain cases, some organizations might also have apps that ISVs provide. You can deploy such apps as native apps or you can containerize the apps by using a MAM solution, such as Endpoint Management. For example, a healthcare organization can create an in-house app that allows physicians to view patient information on mobile devices. An organization can then MAM SDK enable or MDM-wrap the app to secure patient information and enable VPN access to the back-end patient database server.

Web and SaaS apps: These apps include apps accessed from an internal network (web apps) or over a public network (SaaS). Endpoint Management also allows you to create custom web and SaaS apps using a list of app connectors. These app connectors can facilitate single sign-on (SSO) to existing Web apps. For details, see App connector types. For example, you can use Google Apps SAML for SSO based on Security Assertion Markup Language (SAML) to Google Apps.

Mobile productivity apps: Mobile productivity apps are Citrix-developed apps that are included with the Endpoint Management license. For details, see About mobile productivity apps. Citrix also offers other business-ready apps. ISVs develop business-ready apps by using the Mobile Apps SDK.

HDX apps: HDX apps are Windows-hosted apps that you publish with StoreFront. If you have a Citrix Virtual Apps and Desktops environment, you can integrate the apps with Endpoint Management to make the apps available to the enrolled users.

Depending on the type of mobile apps you plan to deploy and manage with Endpoint Management, the underlying configuration and architecture differ. Suppose that multiple groups of users with various levels of permissions consume a single app. In that case, you can create separate delivery groups to deploy two versions of the app. Make sure that the user group membership is mutually exclusive to avoid policy mismatches on user devices.

You might also want to manage iOS application licensing by using Apple volume purchase. This option requires that you register for the Apple volume purchase program. And, you must use the Endpoint Management console to configure volume purchase settings. That configuration allows you to distribute the apps with the volume purchase licenses. Various such use cases make it important to assess and plan your MAM strategy before implementing the Endpoint Management environment. You can start planning your MAM strategy by defining the following:

Types of apps: List the different types of apps you plan to support. Then, categorize the apps, such as public, native, Citrix mobile productivity apps, Web, in-house, and ISV apps. Also, categorize the apps for different device platforms, such as iOS and Android. This categorization helps you to align the Endpoint Management settings that are required for each type of app. For example: Certain apps might not qualify for wrapping. Or, a few apps might require use of the Mobile Apps SDK to enable special APIs for interaction with other apps.

Network requirements: Configure apps with specific network access requirements with the appropriate settings. For example, certain apps might need access to your internal network through VPN. Some apps might require Internet access to route access via the DMZ. To allow such apps to connect to the required network, you have to configure various settings accordingly. Define per-app network requirements to help finalize your architectural decisions up front. That work streamlines the overall implementation process.

Security requirements: Define the security requirements that apply to either individual apps or all the apps. Some settings, such as the MDX policies, apply to individual apps. Session and authentication settings apply across all apps. Some apps might have specific encryption, containerization, wrapping, authentication, geofencing, passcode, or data sharing requirements. Outline those requirements in advance to simplify your deployment.

Deployment requirements: You might want to use a policy-based deployment to allow only compliant users to download the published apps. For example, you might want certain apps to require that:

• device platform-based encryption is enabled
• the device is managed
• the device meets a minimum operating system version
• certain apps are available only to corporate users

Outline such requirements in advance so that you can configure the appropriate deployment rules or actions.

Licensing requirements: Record app-related licensing requirements. Such notes help you to manage license usage effectively and to decide if you need to configure specific features in Endpoint Management to facilitate licensing. For example, if you deploy a free or paid iOS app, Apple enforces licensing requirements on the app by making users sign on to their Apple Store account. You can register for Apple volume purchase to distribute and manage these apps through Endpoint Management. Volume purchase allows users to download the apps without having to sign into their Apple Store account. Also, tools, such as Samsung Knox, have special licensing requirements, which you need to complete before deploying those features.

Allow list and block list requirements: You likely want to prevent users from installing or using some apps. Create an allow list of apps that make a device out of compliance. Then, set up policies to trigger when a device becomes non-compliant. On the other hand, an app might be acceptable for use but might fall under the block list for some reason. In that case, you can add the app to an allow list and indicate that the app is acceptable to use, but isn’t required. Also, keep in mind that the apps pre-installed on new devices can include some commonly used apps that are not part of the operating system. Those apps might conflict with your block list strategy.

Apps use case

A healthcare organization plans to deploy Endpoint Management to serve as a MAM solution for their mobile apps. Mobile apps are delivered to corporate and BYOD users. IT decides to deliver and manage the following apps:

• Mobile productivity apps: iOS and Android apps provided by Citrix.
• Citrix Files: App to access shared data and to share, sync, and edit files.

Public app store

• Secure Hub: Client used by all mobile devices to communicate with Endpoint Management. IT pushes security settings, configurations, and mobile apps to mobile devices via the Secure Hub client. Android and iOS devices enroll in Endpoint Management through Secure Hub.
• Citrix Workspace app: Mobile app that allows users to open on mobile devices apps hosted by Citrix Virtual Apps.
• GoToMeeting: An online meeting, desktop sharing, and video conferencing client that lets users meet with other computer users, customers, clients, or colleagues via the Internet in real time.
• SalesForce1: Salesforce1 lets users access Salesforce from mobile devices and brings all Chatter, CRM, custom apps, and business processes together in a unified experience for any Salesforce user.
• RSA SecurID: Software-based token for two-factor authentication.
• EpicCare apps: These apps give healthcare practitioners secure and portable access to patient charts, patient lists, schedules, and messaging.
  • Haiku: Mobile app for the iPhone and Android phones.
  • Canto: Mobile app for the iPad
  • Rover: Mobile apps for iPhone and iPad.

HDX: Citrix Virtual Apps delivers HDX apps to Citrix Workspace.

• Epic Hyperspace: Epic client application for electronic health record management.

ISV

• Vocera: HIPAA compliant voice-over IP and messaging mobile app that extends the benefits of Vocera voice technology anytime, anywhere via iPhone and Android smartphones.

In-house apps

• HCMail: App that helps compose encrypted messages, search address books on internal mail servers, and send the encrypted messages to the contacts using an email client.

In-house web apps

• PatientRounding: Web application used to record patient health information by different departments.
• Outlook Web Access: Allows the access of email via a web browser.
• SharePoint: Used for organization-wide file and data sharing.

The following table lists the basic information required for MAM configuration.

The following tables list specific requirements you can consult when configuring MAM policies in Endpoint Management.

User Communities

Every organization consists of diverse user communities that operate in different functional roles. These user communities perform different tasks and office functions using various resources that you provide through user devices. Users might work from home or in remote offices using mobile devices that you provide. Or, users might own their mobile devices, which allows them to access tools that are subject to certain security compliance rules.

As more user communities start using mobile devices in their job role, Enterprise Mobility Management (EMM) becomes critical to prevent data leaks. EMM is also critical to enforce an organization’s security restrictions. For efficient and more sophisticated mobile device management, you can categorize your user communities. Doing so simplifies the mapping of users to resources and aligns the appropriate security policies to users.

The following example illustrates how the user communities of a healthcare organization are classified for EMM.

User communities use case

This example healthcare organization provides technology resources and access to multiple users, including network and affiliate employees and volunteers. The organization has chosen to roll out the EMM solution to non-executive users only.

User roles and functions for this organization can be broken into subgroups including: clinical, non-clinical, and contractors. Selected users receive corporate mobile devices, while others can access limited company resources from their personal devices. To enforce the right level of security restrictions and prevent data leaks, the organization decided that corporate IT manages each enrolled device. Those devices might be corporate-owned or Bring Your Own Device (BYOD). Also, users can only enroll a single device.

The following section provides an overview of the roles and functions of each subgroup:

Clinical

• Nurses
• Physicians (Doctors, Surgeons, and so on)
• Specialists (Dieticians, anesthesiologists, radiologists, cardiologists, oncologists, and so on)
• Outside physicians (Non-employee physicians and office workers that work from remote offices)
• Home Health Services (Office and mobile workers performing physician services for patient home visits)
• Research Specialist (Knowledge Workers and Power Users at six Research Institutes performing clinical research to find answers to issues in medicine)
• Education and Training (Nurses, physicians, and specialists in education and training)

Non-Clinical

• Shared Services (Office workers performing various back-office functions, including HR, Payroll, Accounts Payable, and Supply Chain Service)
• Physician Services (Office workers performing various healthcare management, administrative services, and business process solutions to providers, including: Administrative Services, Analytics and Business Intelligence, Business Systems, Client Services, Finance, Managed Care Administration, Patient Access Solutions, Revenue Cycle Solutions, and so on)
• Support Services (Office workers performing various non-clinical functions including: Benefits Administration, Clinical Integration, Communications, Compensation & Performance Management, Facility & Property Services, HR Technology Systems, Information Services, Internal Audit & Process Improvement, and so o.)
• Philanthropic Programs (Office and mobile workers that perform various functions in support of philanthropic programs)

Contractors

• Manufacturer and vendor partners (Onsite and remotely connected via site-to-site VPN providing various non-clinical support functions)

Based on the preceding information, the organization created the following entities. For more information about delivery groups in Endpoint Management, see Deploy resources.

Active Directory Organizational Units (OUs) and Groups

For OU = Endpoint Management Resources:

• OU = Clinical; Groups =
  • XM-Nurses
  • XM-Physicians
  • XM-Specialists
  • XM-Outside Physicians
  • XM-Home Health Services
  • XM-Research Specialist
  • XM-Education and Training
• OU = Non-Clinical; Groups =
  • XM-Shared Services
  • XM-Physician Services
  • XM-Support Services
  • XM-Philanthropic Programs

Endpoint Management Local Users and Groups

For Group= Contractors, Users =

• Vendor1
• Vendor2
• Vendor 3
• … Vendor 10

Endpoint Management Delivery Groups

• Clinical-Nurses
• Clinical-Physicians
• Clinical-Specialists
• Clinical-Outside Physicians
• Clinical-Home Health Services
• Clinical-Research Specialist
• Clinical-Education and Training
• Non-Clinical-Shared Services
• Non-Clinical-Physician Services
• Non-Clinical-Support Services
• Non-Clinical-Philanthropic Programs

Delivery Group and User Group mapping

Delivery Group and Resource mapping

The following tables illustrate the resources assigned to each delivery group in this use case. The first table shows the mobile app assignments. The second table shows the public app, HDX apps, and device management resources.

Notes and considerations

• Endpoint Management creates a default delivery group named All Users during the initial configuration. If you do not disable this delivery group, all Active Directory users have rights to enroll into Endpoint Management.
• Endpoint Management synchronizes Active Directory users and groups on demand using a dynamic connection to the LDAP server.
• If a user is part of a group that is not mapped in Endpoint Management, that user cannot enroll. Likewise, if a user is a member of multiple groups, Endpoint Management only categorizes the user as part of the groups mapped to Endpoint Management.

Security requirements

The scope of security considerations related to an Endpoint Management environment can quickly become overwhelming. There are many interlocking pieces and settings. You might not know where to begin or what to choose to ensure an acceptable level of protection is available. To make these choices simpler, Citrix provides recommendations for High, Higher, and Highest Security, as outlined in the following table.

Security concerns aren’t the only consideration for the mode in which your devices enroll: MAM, MDM+MAM with MDM optional, or MDM+MAM with MDM required. It is important to also review the requirements of the use case and decide if you can mitigate security concerns before choosing your management mode.

High: Using these settings provides an optimal user experience while maintaining a basic level of security acceptable to most organizations.

Higher: These settings create a stronger balance between security and usability.

Highest: Following these recommendations provides a high level of security at the cost of usability and user adoption.

Management mode security considerations

The following table specifies the management modes for each security level.

Notes:

• Depending on the use case, a MAM-only deployment can meet security requirements and provide a good user experience.
• For use cases like BYOD in which all business and security requirements might be satisfied with app containerization only, Citrix recommends MAM-only mode.
• For high security environments (and corporate issued devices), Citrix recommends MDM+MAM to take advantage of all security capabilities available.

Citrix ADC and Citrix Gateway security considerations

The following table specifies the Citrix ADC and Citrix Gateway recommendations for each security level.

Notes:

• Exposing the Endpoint Management server to the Internet via NAT or existing third-party proxies/load-balancers might be an option for MDM. However, in that case, the SSL traffic terminates on an Endpoint Management server, which poses a potential security risk.
• For high security environments, Citrix Gateway with the default Endpoint Management configuration typically meets or exceeds security requirements.
• For MDM enrollments with the highest security needs, SSL termination at Citrix Gateway enables you to inspect traffic at the perimeter, while maintaining end-to-end SSL encryption.
• Options to define SSL/TLS ciphers.
• For more information, see Integrating with Citrix Gateway and Citrix ADC.

Enrollment security considerations

The following table specifies the Citrix ADC and Citrix Gateway recommendations for each security level.

Notes:

• Citrix generally recommends that you restrict enrollment to users in predefined Active Directory groups only. This restriction requires disabling the built-in All users delivery group.
• You can use enrollment invitations to restrict enrollment to users with an invitation. Enrollment invitations aren’t available for Windows devices.
• You can use one-time PIN (OTP) enrollment invitations as a two-factor authentication solution and to control the number of devices a user can enroll. (OTP invitations aren’t available for Windows devices.)

Device passcode security considerations

The following table specifies the device passcode recommendations for each security level.

Notes:

• Citrix recommends the use of a device passcode.
• You can enforce a device passcode via an MDM policy.
• You can use an MDX policy to make a device passcode a requirement for using managed apps; for example, for BYOD use cases.
• Citrix recommends combining the MDM and MDX policy options for increased security for MDM+MAM enrollments.
• For environments with the highest security requirements, you can configure complex passcode policies and enforced them with MDM. You can configure automatic actions to notify administrators or issue selective/full device wipes when a device doesn’t comply with a passcode policy.