This document discusses the need for companies to transform their security approaches to adapt to new technologies and a more distributed workforce. It summarizes Google's BeyondCorp zero-trust security framework, which shifts access controls from the network perimeter to individual devices and users. This allows employees to work securely from any location without needing a traditional VPN. The framework uses principles of conditional, context-aware, and dynamic access controls. It establishes identity as the control plane and assumes all resources are internet-accessible. Layered authentication and policy enforcement techniques are used to securely grant access based on factors like user, device, application type, and location. Citrix products are presented as tools to implement equivalent functionality through features like user and device authentication, intelligent policies,

1. Enterprise Security Reloaded
Citrix update 2019

2. John Chambers | Executive
Chairman, Cisco System
“At least 40% of all
businesses will die in the
next 10 years… if they don’t
figure out how to change
their entire company to
accommodate new
technologies”
40
%

3. John Chambers | Executive
Chairman, Cisco System
“At least 40% of all
businesses will die in the
next 10 years… if they don’t
figure out how to change
their entire company to
accommodate new
technologies”

4. The world is
CHANGING

5. Companies must
TRANSFORM

6. On-Site Data On-Premise
+ ERP Apps
Company-Issued
Desktops
Office Workers Within Datacenter On-Premise
MOST COMPANIES ARE MID-TRANSFORMATION

7. MOST COMPANIES ARE MID-TRANSFORMATION
Cloud / Mobile Era

8. MOST COMPANIES ARE MID-TRANSFORMATION
Multiple Cloud
Storage Zones
SaaS and
Mobile Apps
PC’s, Laptops,
Tablets, Smartphones,
Connected Things
Work Anywhere, Contractors,
Multi-Generational
Workforce
Branch Operations, and
Hybrid-Multi Cloud

9. So is our way of
WORKING

10. On-premises /
Private cloud

11. On-premises /
Private cloud

12. Experience +
Productivity
Control +
Security
DUALITY

13. A NEW VISION ON THE
WORKPLACE

14. FOCUSED
on the USER &
CONTEXT

15. That MOVES BEYOND the
PERIMETER

16. Enterprise security reinvented : Beyond Corp / Zero trust
Source: https://www.beyondcorp.com/
“BeyondCorp is a Zero Trust security framework
modeled by Google that shifts access controls from
the perimeter to individual devices and users. The
end result allows employees to work securely from
any location without the need for a traditional VPN.

17. The guiding principles of beyond corp
a.k.a. zero trust, Conditional or contextual access
Perimeterless Design Context-Aware Dynamic Access Controls
Connecting from a particular network
must not determine
Which services you can access
Access to services is granted
based on what we know about
you and your device
All access to services must be
authenticated, authorized and
encrypted

18. In practice
Establish identity as the
control plane
Assume every resource is
on the open internet
Never trust – always verify

19. Layered approach

20. Core building blocks
UEM / EMM Identity federation Policy engine

21. CONDITIONS CONTROLS
Session Risk
Effective
policy
MACHINE
LEARNING
REAL TIME
EVALUATION
ENGINE
POLICIES
Employee & Partner
Users & Roles
Trusted &
Compliant Devices
Location
Client apps &
Auth Method
Allow/block
access
Limited
access
Require
MFA
Force password
reset
Terms of Use

22. Basic goals
CONDITIONAL
ACCESS
Keep user accounts safe based on location & risk
Keep data safe by only allowing managed devices
Meet compliancy requirements
Enable security without compromising experience

23. USERS
UNTRUSTED DEVICES TRUSTED DEVICES
ANY NETWORK
ENTRY POINT LAYER
DEVICE AUTH BYPASS
LAYER
DEVICE AUTH LAYER
USER AUTH BYPASS
LAYER
USER AUTH LAYER
ACCESS TERMINATION
LAYER
APPLICATION BACK-END LAYER
Theoretical architecture

24. USERS
UNTRUSTED DEVICES TRUSTED DEVICES
INTERNAL OR EXTERNAL NETWORK
FIREWALL / LOAD BALANCER / REVERSE PROXY
DEVICE AUTH BYPASS
LAYER
EMM / UEM
USER AUTH BYPASS
LAYER
SF AUTH / MF AUTH / BIOMETRICS
LEGACY APPS
(RDSH / VDI / App proxy)
MODERN APPS ( MODERN AUTH, CONTAINERIZED)
Theoretical architecture

25. USERS
UNTRUSTED DEVICES TRUSTED DEVICES
INTERNAL OR EXTERNAL NETWORK
CITRIX ADC / CITRIX SDWAN
CITRIX CEM CITRIX CEM
CITRIX CLOUDCITRIX CLOUD (INTELLIGENCE)
CITRIX APPS &
DESKTOPS
CITRIX CLOUD / CITRIX ADC
Product translation

26. Security
Citrix Analytics

27. 28
Closed-loop, autonomous system to dynamically adjust security
Citrix Analytics
Security
User Behavior Security Analytics
• Prevent internal threats & data exfiltration attacks
• Track & model individual User behaviors across enterprise
• Identify & aggregate User Risky behaviors into Risk Profiles
Application Security Analytics
• Protect Applications from external attacks
• Track, access and rank applications based on risks
• Suggest mitigation steps to enhance security
Data Security Analytics
• Prevent internal threats & data exfiltration attacks
• Track ‘sensitive files’ via DLP engines
Security Analytics to establish Secure Digital Perimeter

28. Sophisticated attacks require
a sophisticated response
Machine Learning and Artificial
Intelligence
Engineered for hybrid architectures
Gain insights and prevention, not data

29. 30
Security Analytics
Descriptive
What happened?
Diagnostic
How it happened?
Predictive
What will happen?
Prescriptive
What to do?
Excessive (sensitive)
file downloads
Stolen
credentials
Loss of
(sensitive) data
Quarantine
User

30. User Behavior Security
Analytics

31. The user threat
Survey: Most frequently used
security breach tactic: compromised
credentials and weak passwords.1
User Behavior Analytics
81%
of breaches -
compromised
credentials or weak
passwords
1. Verizon Data Breach Investigations Report (DBIR) 2017

32. ▪ Detect & mitigate threats
from trusted internal users
with malicious intent
▪ Easily identify high risk users
with drill-down capabilities
on behavior
▪ Apply corrective actions
User Behavior Security Analytics

33. care.grow.passion.