Secure Deployment Guide for Citrix Cloud Japan

The Secure Deployment Guide for Citrix Cloud Japan provides an overview of security best practices when using Citrix Cloud Japan and describes the information Citrix collects and manages.

Technical security overviews for other services

Consult the following articles for more information about data security within Citrix Cloud Japan services:

• Citrix Gateway service Technical Security Overview
• Citrix DaaS Technical Security Overview (formerly Virtual Apps and Desktops service)
• Workspace Environment Management service Customer Data Management

Guidance for administrators

• Use strong passwords and regularly change your passwords.
• All administrators within a customer account can add and remove other administrators. Ensure that only trusted administrators have access to Citrix Cloud Japan.
• Administrators of a customer have, by default, full access to all services. Some services provide a capability to restrict the access of an administrator. Consult the per-service documentation for more information.
• Two-factor authentication for administrators is achieved using Citrix Cloud Japan’s integration with Azure Active Directory.

Password compliance

Citrix Cloud Japan prompts administrators to change their passwords if one of the following conditions exists:

• The current password hasn’t been used to sign in for more than 60 days.
• The current password has been listed in a known database of compromised passwords.

New passwords must meet all of the following criteria:

• At least 8 characters long (128 characters maximum)
• Includes at least one upper-case and lower-case letter
• Includes at least one number
• Includes at least one special character: ! @ # $ % ^ * ? + = -

Rules for changing passwords:

• The current password can’t be used as a new password.
• The previous 5 passwords can’t be reused.
• The new password can’t be similar to the account user name.
• The new password must not be listed in a known database of compromised passwords. Citrix Cloud uses a list provided by https://haveibeenpwned.com/ to determine if new passwords violate this condition.

Encryption and key management

The Citrix Cloud Japan control plane does not store sensitive customer information. Instead, Citrix Cloud Japan retrieves information such as administrator passwords on-demand (by asking the administrator explicitly). There is no data-at-rest that is sensitive or encrypted; therefore, you do not need to manage any keys.

For data-in-flight, Citrix uses industry standard TLS 1.2 with the strongest cipher suites. Customers cannot control the TLS certificate in use, as Citrix Cloud Japan is hosted on the Citrix-owned cloud.jp domain. To access Citrix Cloud Japan, customers must use a browser capable of TLS 1.2, and must have accepted cipher suites configured.

• If accessing the Citrix Cloud control plane from Windows Server 2016, Windows Server 2019 or Windows Server 2022, the following strong ciphers are recommended: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• If accessing the Citrix Cloud control plane from Windows Server 2012 R2, the strong ciphers are not available, so the following ciphers must be used: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

For more information about encryption and key management within each cloud service, consult the service’s documentation.

For more information about TLS 1.2 configuration, consult the following articles:

• CTX245765 Error: “The underlying connection was closed: An unexpected error occurred on a send.” when querying Monitoring Service’s OData endpoint
• Update and configure the .NET Framework to support TLS 1.2 on the Microsoft Docs web site.

Data sovereignty

The Citrix Cloud Japan control plane is hosted in Japan. Customers do not have control over this.

The customer owns and manages the resource locations that they use with Citrix Cloud Japan. A resource location can be created in any data center, cloud, location, or geographic area the customer desires. All critical business data (such as documents, spreadsheets, and so on) are stored in resource locations and are under the customer’s control.

Security issues insight

The website status.cloud.com provides transparency into security issues that have an ongoing impact on the customer. The site logs status and uptime information. There is an option to subscribe to updates about the platform or individual services.

Citrix Cloud Connector

Installation

For security and performance reasons, Citrix recommends that customers do not install the Cloud Connector software on a domain controller.

Also, Citrix strongly recommends that the machines on which the Cloud Connector software is installed reside within the customer’s private network and not in the DMZ. For network and system requirements and instructions for installing the Cloud Connector, see Create a resource location.

Configuration

The customer is responsible for keeping the machines on which the Cloud Connector is installed up-to-date with Windows security updates.

Customers can use antivirus alongside the Cloud Connector. Citrix tests with McAfee VirusScan Enterprise + AntiSpyware Enterprise 8.8. Citrix will support customers who use other industry standard AV products.

In the customer’s Active Directory (AD) the Cloud Connector’s machine account should be restricted to read-only access. This is the default configuration in Active Directory. Additionally, the customer can enable AD logging and auditing on the Cloud Connector’s machine account to monitor any AD access activity.

Logging on to the machine hosting the Cloud Connector

The Cloud Connector allows sensitive security information to pass through to other platform components in Citrix Cloud services, but also stores the following sensitive information:

• Service keys for communicating with Citrix Cloud
• Hypervisor service credentials for power management in Citrix DaaS

This sensitive information is encrypted using the Data Protection API (DPAPI) on the Windows server hosting the Cloud Connector. Citrix strongly recommends allowing only the most privileged administrators to log on to Cloud Connector machines (for example, to perform maintenance operations). In general, there is no need for an administrator to log on to these machines to manage any Citrix product. The Cloud Connector is self-managing in that respect.

Do not allow end users to log on to machines hosting the Cloud Connector.

Installing additional software on Cloud Connector machines

Customers can install antivirus software and hypervisor tools (if installed on a virtual machine) on the machines where the Cloud Connector is installed. However, Citrix recommends that customers do not install any other software on these machines. Other software creates additional possible security attack vectors and might reduce the security of the overall Citrix Cloud Japan solution.

Inbound and outbound ports configuration

The Cloud Connector requires outbound port 443 to be open with access to the internet. The Cloud Connector should have no inbound ports accessible from the Internet.

Customers can locate the Cloud Connector behind a web proxy for monitoring its outbound Internet communications. However, the web proxy must work with SSL/TLS encrypted communication.

The Cloud Connector might have additional outbound ports with access to the Internet. The Cloud Connector will negotiate across a wide range of ports to optimize network bandwidth and performance if additional ports are available.

The Cloud Connector must have a wide range of inbound and outbound ports open within the internal network. The table below lists the base set of open ports required.

Each of the services used within Citrix Cloud Japan will extend the list of open ports required. For more information, consult Connectivity requirements for Citrix Cloud Japan.

Monitoring outbound communication

The Cloud Connector communicates outbound to the Internet on port 443, both to Citrix Cloud Japan servers and to Microsoft Azure Service Bus servers.

The Cloud Connector communicates with domain controllers on the local network that are inside the Active Directory forest where the machines hosting the Cloud Connector reside.

During normal operation, the Cloud Connector communicates only with domain controllers in domains that are not disabled on the Identity and Access Management page in the Citrix Cloud Japan user interface.

Each service within Citrix Cloud Japan extends the list of servers and internal resources that the Cloud Connector might contact in the course of normal operations. Also, customers cannot control the data that the Cloud Connector sends to Citrix. For more information about services’ internal resources and data sent to Citrix, consult the following resources:

• Technical Security Overviews for each service (listed at the beginning of this article)
• Connectivity Requirements for supported cloud services

Viewing Cloud Connector logs

Any information relevant or actionable to an administrator is available in the Windows Event Log on the Cloud Connector machine.

View installation logs for the Cloud Connector in the following directories:

• %AppData%\Local\Temp\CitrixLogs\CloudServicesSetup
• %windir%\Temp\CitrixLogs\CloudServicesSetup

Logs of what the Cloud Connector sends to the cloud are found in %ProgramData%\Citrix\WorkspaceCloud\Logs.

The logs in the WorkspaceCloud\Logs directory are deleted when they exceed a specified size threshold. The administrator can control this size threshold by adjusting the registry key value for HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CloudServices\AgentAdministration\MaximumLogSpaceMegabytes.

SSL/TLS Configuration

The Windows Server hosting the Cloud Connector must have the ciphers detailed in Encryption and key management enabled.

The Cloud Connector must trust the certification authority (CA) that the Citrix Cloud SSL/TLS certificates and Microsoft Azure Service Bus SSL/TLS certificates use. Citrix and Microsoft might change certificates and CAs in the future, but always use CAs that are part of the standard Windows Trusted Publisher list.

Each service within Citrix Cloud Japan might have different SSL configuration requirements. For more information, consult the Technical Security Overviews for each service (listed at the beginning of this article).

Connector updates

When Citrix software updates are available, the Cloud Connector self-manages by default. For more information about configuring an update schedule, see Connector updates.

Do not disable reboots or put other restrictions on the Cloud Connector. These actions prevent the Cloud Connector from updating itself when there is a critical update.

The customer is not required to take any other action to react to security issues. The Cloud Connector automatically applies any security fixes and updates for Citrix software.

Guidance for handling compromised accounts

• Audit the list of administrators in Citrix Cloud Japan and remove any who are not trusted.
• Disable any compromised accounts within your company’s Active Directory.
• Contact Citrix and request rotating the authorization secrets stored for all the customer’s Cloud Connectors. Depending on the severity of the breach, take the following actions:
  • Low Risk: Citrix can rotate the secrets over time. The Cloud Connectors will continue to function normally. The old authorization secrets will become invalid in 2-4 weeks. Monitor the Cloud Connector during this time to ensure that there are no unexpected operations.
  • Ongoing high risk: Citrix can revoke all old secrets. The existing Cloud Connectors will no longer function. To resume normal operation, the customer must uninstall and reinstall the Cloud Connector on all applicable machines.