Give users access to apps, not your network

Before a session is established, Citrix SecurAccess ZTNA authenticates a user’s identity using device posture assessment, multi-factor authentication (MFA), and adaptive authentication. This information is then used for contextual application access and single sign-on.

Citrix StoreFront integration

Citrix SecurAccess ZTNA integrates with Citrix StoreFront^™ — the portal where users access their virtual desktops and applications via single sign-on (SSO) — to enforce access policies at a single point. And, conveniently for users, they can see and access all of their approved applications in Citrix StoreFront, including web and SaaS applications as well the applications they access through VDI.

User authentication

When a user attempts to access applications or desktops through Citrix StoreFront, Citrix SecurAccess ZTNA ensures that the user is authenticated using identity-aware authentication methods for added security, including MFA.

Adaptive authentication

Citrix SecurAccess ZTNA uses adaptive authentication methods that can adjust based on the risk profile of the user’s activity. For example, users attempting to access sensitive applications may be required to provide additional verification.

Logging and monitoring

Detailed logging and monitoring help you meet regulatory requirements and improve your overall security posture.

Citrix SecurAccess ZTNA uses the zero trust principle of "never trust, always verify" to ensure that access to applications and data is continuously verified. Access policies are dynamically evaluated based on contextual factors like user location, device status, and network trust. For example, access might be restricted or additional authentication might be required if a user connects from an untrusted network.

User identity

• Unified identity management: Citrix SecurAccess ZTNA integrates with identity and access management (IAM) solutions like Cisco Duo, Ping, Entra ID, and Okta to ensure that user identities are verified and managed consistently. This integration supports single sign-on (SSO) and multi-factor authentication (MFA) to enhance security.
• Role-based access control (RBAC): Least-privilege access rights are assigned based on the user’s role within the organization, ensuring that users only have access to the applications and data necessary for their job functions.
• Verification: User identity is verified through strong authentication methods, including MFA, to confirm the identity of the user before granting access.

Device posture

• Compliance checks: Real-time assessments of the device’s security posture include checking for antivirus status, OS updates, and other compliance requirements.
• Endpoint management: Devices must meet certain security standards before access is granted, ensuring that only secure and compliant devices can connect to the network.

Location and network context

• Geolocation: Access policies can take the user’s geographic location into account. For example, access may be restricted or additional authentication may be required if a user is attempting to connect from an unusual or high-risk location.
• Network trust: Connections from unknown or untrusted networks can trigger stricter access controls or be blocked entirely.

Citrix SecurAccess ZTNA provides flexible options for your secure access needs with both agent-based and agentless options that allow you to balance advanced security with ease of use.

Agent-based secure access

Agent-based access requires installing a client or agent software on the user's device – unless you are already using Citrix NetScaler as a VPN. That’s because a NetScaler VPN shares the same agent as Citrix SecurAccess ZTNA, so no new installs or upgrades are needed. Agent-based access is best for:

• Managed devices: Ideal for corporate-owned devices in environments requiring strict security controls and comprehensive endpoint management.
• Comprehensive security controls: Agent can enforce security policies on the endpoint, such as antivirus checks, firewall settings, and compliance with corporate security standards.
• Device posture assessment: Agent continuously assesses the device's security posture, ensuring it meets the organization’s requirements before granting access to applications.
• Full visibility and monitoring: Provides detailed insights into user activities, device status, and network traffic, enabling better monitoring and threat detection.
• Dynamic access revocation: Enforces continuous zero trust network access so that if a user's behavior, device posture, or context changes and no longer meets the set security policies, access can be immediately revoked.
• Advanced capabilities: Supports advanced capabilities like secure tunneling and encryption and, with the use of Citrix SecurAccess with Chrome Enterprise, also supports data loss prevention (DLP) measures.

Agentless browser-based secure access

Agentless access provides quick, easy, and flexible access through a secure web browser without compromising basic security requirements and is best for:

• Ease of use: Users access resources through a standard web browser, eliminating the need for software installation, or through Citrix SecurAccess with Chrome Enterprise.
• Unmanaged devices: Ideal for employees, partners, and contractors using personal devices because it does not require installing software on their devices.
• Standard security controls: Ensures secure connections with web-based secure access methods, such as reverse proxies, without compromising security.
• Full visibility and monitoring: Provides detailed insights into user activities, device status, and network traffic, enabling better monitoring and threat detection.
• Dynamic access revocation: Enforces continuous zero trust network access so that if a user's behavior, device posture, or context changes and no longer meets the set security policies, access can be immediately revoked.
• Quick deployment: Faster to deploy because it does not require installation software on users’ personal devices, making it easier to support bring-your-own device (BYOD) initiatives.
• Temporary access: Provides quick, temporary access to resources without the need for software installation.

Instead of granting broad network access, Citrix SecurAccess ZTNA enforces policies that grant access to specific applications. This reduces the attack surface by limiting user access to only the applications that are necessary for the user’s job function.

Application-specific access controls include:

• Granular access: Access is granted on a per-application basis, ensuring that users can only access the specific applications they are authorized to use. This minimizes the risk of unauthorized access to other network resources​
• Policy enforcement: Access policies are defined based on user roles, device posture, and other contextual factors to determine which applications a user can access and under what conditions.
• Continuous monitoring: Application access is continuously monitored, and any deviations from normal behavior can trigger security responses, such as additional verification steps or session termination.
• Remote browser isolation: Secure access to unsanctioned websites via remote browser isolation protects against malware, phishing, and other web-based threats by executing web browsing sessions in the cloud, rather than on the user's local device.