Next-generation application security |
Over 70 percent of successful Internet attacks now exploit vulnerabilities in the application or the application platform. NetScaler protects against a wide variety of threats with integrated security capabilities that protect application resources, augmenting existing network-layer security protections. AppFirewall SecurityThe NetScaler AppFirewall secures web applications, prevents inadvertent or intentional disclosure of confidential information and aids in compliance with information security regulations such as PCI-DSS. The AppFirewall is available as a standalone security appliance or as a fully integrated module of the NetScaler application delivery solution and is included with Citrix NetScaler, Platinum Edition. Key features include:
Common threats defeated by NetScaler AppFirewall Expand all sectionsCross-site scripting (XSS) attacksA cross-site scripting attack (XSS), sends a web application an unvalidated script that activates when it is read by the browser or application to steal user identities, hijack user sessions, poison cookies, redirect users to malicious web sites, access restricted sites and even launch false advertisements. AppFirewall has dynamic context sensitive XSS attack protections that looks for anything that looks like an HTML tag and checks against allowed HTML attributes and tags to detect XSS attacks. Custom XSS patterns can be stored to modify this default list of tags and attributes. Both HTML and XML payloads are inspected. Field format protection and form field consistency is included. Cross-site request forgery (CSRF)Cross-site request forgery (CSRF) attacks post an executable script that will run on a browser. An unsuspecting user will download the page and the script sends a forged HTTP request, including the victim's session cookie and any other authentication information, to a vulnerable web application. To block such attacks, AppFirewall provides CSRF form tagging where a unique token is added to each form sent to the client and requests are checked to see if it contains the unique tag ID provided by NetScaler. In addition, referrer header protection is included whereby CSRF attacks are blocked by checking if the referrer header is coming from an authorized site. SQL and command injection threatsWeb applications have database access privileges and are used to get to the SQL database. Fragments of SQL commands are sent to the web applications which in turn are passed to databases for execution. AppFirewall protects against SQL injection by monitoring for a combination of SQL key words and punctuation. Custom injection patterns can be stored to protect against any type of injection attack including XPath and LDAP. Field format protection features allow the administrator to restrict any user parameter to a regular expression. Form fields are checked for consistency to validate user forms against the user session form signatures to ensure validity of all form elements. XML-based attacksAppFirewall includes a rich set of XML-specific security protections and secures all flavors of XML. These include schema validation to thoroughly verify SOAP messages and XML payloads, and a powerful XML attachment check to block attachments containing malicious executables or viruses. AppFirewall also thwarts a variety of DoS attacks, including external entity references, recursive expansion, excessive nesting and malicious messages containing either long or a large number of attributes and elements. Advanced XML Protections include WSDL Scanning prevention and blocking of XPath injection attacks. Buffer overflow attacksBuffer overflow attacks, among the most common application-layer exploits (Code Red and Nimda are well-known examples), attempt to overflow an input buffer with excessive data, enabling it to run a remote shell on the machine and gain the same system privileges granted to the application being attacked. AppFirewall performs a deep stream inspection on all HTTP traffic to block buffer overflows anywhere in a client request and limits input parameter sizes for URLs, headers and cookies. Leakage of sensitive dataAppFirewall business object protection prevents the unauthorized and inadvertent leakage of sensitive customer or corporate information. If a sensitive data object is detected in a server response, AppFirewall can block the page, strip or mask the object. AppFirewall ensures that no information is sent from the web server that would compromise customer data and result in potential identity theft. Citrix Business Object Protection modules are ideal for achieving regulatory compliance with Gramm-Leach-Bliley, the California Database Breach Act and other privacy mandates. Strong SSL application protectionNetScaler MPX and SDX appliances are performance optimized for the strongest SSL encryption levels, including 2048-bit and longer keys. NetScaler appliances integrate state-of-the-art cryptographic acceleration technology, and optimize these capabilities to deliver the fastest SSL performance in the industry.
Support for XenMobile MDMNetScaler provides three capabilities for XenMobile Device Manager Servers:
Denial of Service (DoS) protectionNetScaler stops damaging denial of service attacks, such as SYN Flood, HTTP DoS, and Ping of Death, while still allowing legitimate users to maintain access to critical application resources. It implements an enhanced SYN cookie mechanism that operates at wire-speed to provide superior attack protection, even against broadly distributed clients causing traffic floods. Key protection methods:
Secure Remote Access with NetScaler GatewayCitrix NetScaler Gateway is a proven SSL VPN solution that delivers secure remote access for applications, and is the best SSL VPN solution to deliver secure virtual desktops. Citrix NetScaler Gateway protects data and empowers the user to work in any location by:
FIPS ComplianceCitrix offers NetScaler ADC solutions that are compliant with Federal Information Processing Standards (FIPS), and support more than 4.5 Gbps of SSL throughput. Key PCI-DSS mandates met by AppFirewall Expand all sectionsSection 1.2: Deny traffic from untrusted networks and hostsAppFirewall, in conjunction with Citrix Access Gateway Enterprise Edition, restricts access to applications and data by allowing only the use of approved protocols and methods, only connections from trusted networks and only access to users who are authenticated and authorized. AppFirewall has obtained ICSA Labs Web AppFirewall Certification for additional assurance. Section 3.3: Mask account numbers when displayedAppFirewall is easily configured to mask or block PANs and otherwise prevent the leakage of sensitive cardholder data, regardless of programmer oversight, logic flaws or targeted attacks. Complete server responses with PAN data can be blocked from being transmitted to the requesting client. Section 3.5: Protect encryption keys against disclosure and misuseFIPS is a consideration within PCI DSS compliance. Four NetScaler appliances including the integrated AppFirewall module are FIPS 140-2 Level 2 compliant. These appliances securely maintain the certificates and encryption keys used for SSL/TLS and are all available in the FIPS versions of MPX 9700, MPX 10500, MPX 12500 and MPX 15500. Section 4.1: Use strong cryptography and security protocolsAppFirewall can be used to SSL-enable applications that were not designed to use secure communication protocols and support strong SSL cryptography with key lengths up to 4096-bit. AppFirewall inspects the contents of SSL/TLS encrypted sessions, ensures session validity and blocks attacks. Section 6.6: Audit and correct application code vulnerabilities or institute an application firewallAppFirewall provides continuous protection against attacks with instantaneous attack blockage, dynamically adjusts to code changes and supports multiple applications simultaneously. |
