Citrix Web Interface - VPN - public computer...secure??

[Don Joly]

We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
 
Thanks,
Don



_________________________________________________________________
The i’m Talkaton. Can 30-days of conversation change the world?
http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

[K. Brian Kelley-2]

Public computers? I wouldn't consider that safe. One just has to do a Google search on Kinkos and GoToMyPC to see why. With a public computer there is absolutely no guarantee of any sort of reasonable precautions such as up-to-date AV. If you were using Citrix Access Gateway you could do some level of endpoint analysis, but that's not the case with CSG.

 K. Brian Kelley, CISA, MCSE, Security+
Contributing Author: How to Cheat at Securing SQL Server 2005
Regular Columnist, SQLServerCentral.com and SQL Server Standard Magazine
http://www.truthsolutions.com/
http://blogs.sqlservercentral.com/brian_kelley/default.aspx



----- Original Message ----
From: Don Joly <fuwmanchew@...>
To: security-basics@...
Sent: Wednesday, July 9, 2008 11:17:02 PM
Subject: Citrix Web Interface - VPN - public computer...secure??


We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?

Thanks,
Don



_________________________________________________________________
The i’m Talkaton. Can 30-days of conversation change the world?
http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

[infolookup]

IMHO, it really matters who is logging in and what access rights the have, I would recommend look at a video presentation from this years Shmoocon on Citirix security.

If your over all network setup is secure and someone steals a set of login creds the most the can do is impersonate that user and try to gather information from the inside.

Level of severity to me depends on what the user/ attacker can come away with.
------Original Message------
From: Don Joly
Sender: listbounce@...
To: security-basics@...
Sent: Jul 9, 2008 11:17 PM
Subject: Citrix Web Interface - VPN - public computer...secure??


We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
 
Thanks,
Don



_________________________________________________________________
The i’m Talkaton. Can 30-days of conversation change the world?
http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

Sent from my Verizon Wireless BlackBerry

[ॐ aditya mukadam ॐ]

First of all let me say comment/compliment that the policy for WebVPN
set up is done really well and correctly. It is an absolutely bad idea
to allow intranet access from public computers because of reasons like
it might have keylogger, virus on it, vulnerable OS which can allow
user to hack that public pc ( while you are connected to intranet via
WebVPN) n so on.

If you still want to do it, you can develop seperate group of
resources (which won't hurt you n your company if it gets exposed to
threats etc) inshort -'not so important resources'. You should create
seprate group to allow users to connect to it from public computer if
you  want to. However, please understand the risks you are taking in
such cases.

Remember my friend, security is often compromised for the ease of use !!!

Thanks,
Aditya Govind Mukadam

On Thu, Jul 10, 2008 at 8:47 AM, Don Joly <fuwmanchew@...> wrote:

>
> We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
>
> Thanks,
> Don
>
>
>
> _________________________________________________________________
> The i'm Talkaton. Can 30-days of conversation change the world?
> http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

[Robert Taylor-12]

I would consider public computers to be a bad idea. You have no idea who
set them up or what is running on them. Keystroke loggers/Screen
recorders that are installed on purpose or via a virus can easily
capture all data from your transaction. You can't guarantee that the
public computer has a firewall, os patches, or antivirus on it. SecureID
can mitigate some of the password issues, but malicious people can still
capture all the data, both keystrokes and screen data that goes through
the device. Someone who opens a PO or looks at a pdf of a credit card
receipt could inadvertently expose sensitive data.

Hot spots only provide connectivity, so hopefully, as long as you use
the proper precautions to ensure that someone can't perform a MITM
attack or otherwise compromise the secure channel or compromise the
machine/laptop over the network they could be ok. Beware the
shoulder-surfer tho.

rgt

Don Joly wrote:

> We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
>  
> Thanks,
> Don
>
>
>
> _________________________________________________________________
> The i’m Talkaton. Can 30-days of conversation change the world?
> http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

[ॐ aditya mukadam ॐ]

I know of devices like F5 firepass and Juniper IVEs in which you can
configure separate groups with separate policies. You might wanna
consider those into your existing set up . All da very best !!!

Thanks,
Aditya Govind Mukadam

On Fri, Jul 11, 2008 at 12:36 AM, Don Joly <fuwmanchew@...> wrote:

> You bring up some very good points. Thank you so much for taking the time to
> respond. It is very much appreciated!
>
> Don
>
>> Date: Thu, 10 Jul 2008 21:39:55 +0530
>> From: aditya.mukadam@...
>> To: fuwmanchew@...; security-basics@...
>> Subject: Re: Citrix Web Interface - VPN - public computer...secure??
>>
>> First of all let me say comment/compliment that the policy for WebVPN
>> set up is done really well and correctly. It is an absolutely bad idea
>> to allow intranet access from public computers because of reasons like
>> it might have keylogger, virus on it, vulnerable OS which can allow
>> user to hack that public pc ( while you are connected to intranet via
>> WebVPN) n so on.
>>
>> If you still want to do it, you can develop seperate group of
>> resources (which won't hurt you n your company if it gets exposed to
>> threats etc) inshort -'not so important resources'. You should create
>> seprate group to allow users to connect to it from public computer if
>> you want to. However, please understand the risks you are taking in
>> such cases.
>>
>> Remember my friend, security is often compromised for the ease of use !!!
>>
>> Thanks,
>> Aditya Govind Mukadam
>>
>> On Thu, Jul 10, 2008 at 8:47 AM, Don Joly <fuwmanchew@...> wrote:
>> >
>> > We have a Citrix Secure Gateway that some of our employees use for web
>> > VPN access from home. The Citrix Gateway provides users with published
>> > applications and desktops and has a valid SSL Cert. We have policies that
>> > all must sign agreeing to have some type of firewall enabled, OS patches and
>> > anti-virus software up to date. The policy also states that no user is to
>> > connect to the Citrix Gateway from a "public computer" or from a public hot
>> > spot. I've been asked if we could change this policy to allow connections
>> > from public computers and hot spots but I'm not sure how secure this would
>> > be. Would this be considered safe to allow this type of access? Why or why
>> > not?
>> >
>> > Thanks,
>> > Don
>> >
>> >
>> >
>> > _________________________________________________________________
>> > The i'm Talkaton. Can 30-days of conversation change the world?
>> > http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld
>
>
> ________________________________
> Use video conversation to talk face-to-face with Windows Live Messenger. Get
> started.

[Gleb Paharenko-3]

Hi.

It is very risky to use public networks without two factor
authentication. Consider one time password tokens.

2008/7/10 Don Joly <fuwmanchew@...>:

>
> We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
>
> Thanks,
> Don
>
>
>
> _________________________________________________________________
> The i'm Talkaton. Can 30-days of conversation change the world?
> http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

--
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com
http://www.linkedin.com/in/gpaharenko

[Chris R. Smith]

With GoToMyPc you have one time passwords for security, but not sure about sniffers.






Chris R. Smith * VP of Information Technology * csmith@...
www.sunshinesavingsbank.com
1400 E. Park Avenue * Tallahassee, FL 32301 * [phone] or Toll-Free [phone]

NOTICE OF CONFIDENTIALITY:  This e-mail message and its attachments (if any) may contain confidential and privileged material for the sole use of the intended recipient(s). If you are not the intended recipient of this message, you are hereby notified that any unauthorized review, use, retention, disclosure, dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited.  Delivery of this message to any person other than the intended recipient is not intended to waive any right or privilege.  If you have received this message in error, please promptly notify the sender by reply e-mail and immediately delete this message from your system. Opinions, conclusions and other information in this message that do not relate to the official business of Sunshine Savings Bank shall be understood as neither given nor endorsed by it.



-----Original Message-----
From: listbounce@... [mailto:listbounce@...] On Behalf Of K. Brian Kelley
Sent: Thursday, July 10, 2008 11:11 AM
To: Don Joly; security-basics@...
Subject: Re: Citrix Web Interface - VPN - public computer...secure??

Public computers? I wouldn't consider that safe. One just has to do a Google search on Kinkos and GoToMyPC to see why. With a public computer there is absolutely no guarantee of any sort of reasonable precautions such as up-to-date AV. If you were using Citrix Access Gateway you could do some level of endpoint analysis, but that's not the case with CSG.

 K. Brian Kelley, CISA, MCSE, Security+
Contributing Author: How to Cheat at Securing SQL Server 2005
Regular Columnist, SQLServerCentral.com and SQL Server Standard Magazine
http://www.truthsolutions.com/
http://blogs.sqlservercentral.com/brian_kelley/default.aspx



----- Original Message ----
From: Don Joly <fuwmanchew@...>
To: security-basics@...
Sent: Wednesday, July 9, 2008 11:17:02 PM
Subject: Citrix Web Interface - VPN - public computer...secure??


We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?

Thanks,
Don



_________________________________________________________________
The i'm Talkaton. Can 30-days of conversation change the world?
http://www.imtalkathon.com/?source=EML_WLH_Talkathon_ChangeWorld

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

[Wilson-21]

 Hi all, just on a similar topic, how can I find out which user logon
via Citrix Access Gateway at what time through which policy?

CitrixACE in eventvwr does not provide much information, and I prefer
to use any built in logging rather than external software.
Any suggestions?

Thanks in advance.

Wil

>
> -----Original Message-----
> From: listbounce@... [mailto:listbounce@...] On Behalf Of ? aditya mukadam ?
> Sent: Friday, 11 July 2008 2:10 AM
> To: Don Joly; security-basics@...
> Subject: Re: Citrix Web Interface - VPN - public computer...secure??
>
> First of all let me say comment/compliment that the policy for WebVPN set up is done really well and correctly. It is an absolutely bad idea to allow intranet access from public computers because of reasons like it might have keylogger, virus on it, vulnerable OS which can allow user to hack that public pc ( while you are connected to intranet via
> WebVPN) n so on.
>
> If you still want to do it, you can develop seperate group of resources (which won't hurt you n your company if it gets exposed to threats etc) inshort -'not so important resources'. You should create seprate group to allow users to connect to it from public computer if you  want to. However, please understand the risks you are taking in such cases.
>
> Remember my friend, security is often compromised for the ease of use !!!
>
> Thanks,
> Aditya Govind Mukadam
>
> On Thu, Jul 10, 2008 at 8:47 AM, Don Joly <fuwmanchew@...> wrote:
> >
> > We have a Citrix Secure Gateway that some of our employees use for web VPN access from home. The Citrix Gateway provides users with published applications and desktops and has a valid SSL Cert. We have policies that all must sign agreeing to have some type of firewall enabled, OS patches and anti-virus software up to date. The policy also states that no user is to connect to the Citrix Gateway from a "public computer" or from a public hot spot. I've been asked if we could change this policy to allow connections from public computers and hot spots but I'm not sure how secure this would be. Would this be considered safe to allow this type of access? Why or why not?
> >
> > Thanks,
> > Don
> >
>
>
>