Shared security responsibilities
Actions needed from customers
Following are some of the actions from the customers as part of security best practices.
-
Credentials for accessing the Adaptive Authentication UI: The customer is responsible for creating and maintaining the credentials for accessing the Adaptive Authentication UI. If the customer is working with Citrix Support to resolve an issue, the customer might need to share these credentials with support personnel.
-
Multifactor authentication: As a best practice, customers must configure multifactor authentication policies to prevent unauthorized access to the resources.
-
Authentication Credentials: Customers must configure their authentication credentials as per the general security and password standards.
-
Remote CLI access security: Citrix provides remote CLI access for customers. However, customers are responsible for maintaining the security of the instance during runtime.
-
SSL private keys: As the NetScaler® is under customer control, Citrix does not have any access to the file system. Customers must ensure that they safeguard the certificates and keys that they are hosting on the NetScaler instance.
-
Data backup: Back up the configuration, certificates, keys, portal customizations, and any other file system modifications.
-
Disk images of the NetScaler instances: Maintain and manage the NetScaler disk space and disk clean-up. For details, see Instance Management.
-
For a sample load balanced LDAPS configuration, see Sample LDAP and LDAPS load balancing configuration.
Actions needed from both the customer and Citrix
-
Disaster recovery: In supported Azure regions, the NetScaler high availability instances are provisioned in separate availability zones to safeguard against data loss. In the event of Azure data loss, Citrix recovers as many resources in the Citrix-managed Azure subscription as possible.
In the event of the loss of an entire Azure region, the customer is responsible for rebuilding their customer-managed virtual network in a new region and creating a new VNet peering.
-
Secure access via the public management IP address:
Secure the access to the management interfaces by assigned public IP addresses and allow outbound connectivity to the Internet.