STIGQter: STIG Summary: Citrix Virtual Apps and Desktop 7.x Workspace App Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

Citrix Workspace must implement DoD-approved encryption.

DISA Rule

SV-234261r640180_rule

Vulnerability Number

V-234261

Group Title

SRG-APP-000014

Rule Version

CVAD-WS-000030

Severity

CAT I

CCI(s)

• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000382 - The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.
• CCI-001184 - The information system protects the authenticity of communications sessions.
• CCI-001453 - The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002418 - The information system protects the confidentiality and/or integrity of transmitted information.
• CCI-002420 - The information system maintains the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002421 - The information system implements cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by organization-defined alternative physical safeguards.
• CCI-002422 - The information system maintains the confidentiality and/or integrity of information during reception.
• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
• CCI-002470 - The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Note: For connections that are not remote, this is Not Applicable.

As an administrator, open the Citrix Workspace Group Policy Object administrative template by running gpedit.msc.

Apply the policy on a domain OU containing User Devices running Windows Receiver.

1. Launch the Citrix Workspace Group Policy Object administrative template using the Group Policy Management Console.
2. Under the Computer Configuration node, go to Administrative Templates >> Citrix Workspace >> Network routing and select the TLS and Compliance Mode Configuration policy.
3. Select "Enabled" to enable secure connections and to encrypt communication on the server. Set the following options:
- Select "Require TLS" for all connections to force Citrix Workspace for Windows to use TLS for all connections to published applications and desktops.
- From the Security Compliance Mode drop-down, select the option:
SP800-52 – Select SP800-52 for compliance with NIST SP 800-52.
- Select Full access check and CRL required.
4. Enable FIPS - Select this option to enforce the use of FIPS-approved cryptography. You must also enable the Windows security option from the operating system group policy, System Cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing. Otherwise, Citrix Workspace for Windows might fail to connect to published applications and desktops.
5. From the Allow TLS Servers drop-down, select the port number. Ensure that Citrix Workspace connects only to a specified server by using a comma-separated list. Wildcards and port numbers can be specified. For example, *.citrix.com:4433 allows connections to any server whose common name ends with .citrix.com on port 4433. The issuer of the certificate asserts the accuracy of the information in a security certificate. If Citrix Workspace does not recognize and trust the issuer, the connection is rejected.
6. From the TLS version drop-down, select "TLS 1.2".
7. TLS cipher suite - Select "Government (GOV)".
8. From the Certificate Revocation Check Policy drop-down, select the policy required by the Organizational Security Policy.

Check Contents

Note: For connections that are not remote, this is Not Applicable.

Verify encryption has been enabled on devices running Citrix Workspace:

Open the Citrix Workspace Group Policy Object administrative template by running gpedit.msc.

1. Launch the Citrix Workspace Group Policy Object administrative template using the Group Policy Management Console.
2. Under the Computer Configuration node, go to Administrative Templates >> Citrix Workspace >> Network routing and select the TLS and Compliance Mode Configuration policy.
3. Verify the policy is enabled.

If the policy is not enabled, this is a finding.

4. Verify the following policy options are selected:
- Verify "Require TLS for all connections" is selected.
- From the Security Compliance Mode drop-down, verify "SP800-52" is selected.
- Verify "Full access check and CRL required" is selected.
- Verify "Enable FIPS: is selected.
- From the Allow TLS Servers drop-down, verify the desired port number is entered.
- Verify "TLS 1.2" is selected.
- From the TLS cipher suite drop-down, verify "Select Government (GOV)" is selected.
- From the Certificate Revocation Check Policy drop-down, select the policy required by your Organizational Security Policy.

If any of the policy options noted above are not selected, this is a finding.

Vulnerability Number

V-234261

Documentable

False

Rule Version

CVAD-WS-000030

Severity Override Guidance

Note: For connections that are not remote, this is Not Applicable.

Verify encryption has been enabled on devices running Citrix Workspace:

Open the Citrix Workspace Group Policy Object administrative template by running gpedit.msc.

1. Launch the Citrix Workspace Group Policy Object administrative template using the Group Policy Management Console.
2. Under the Computer Configuration node, go to Administrative Templates >> Citrix Workspace >> Network routing and select the TLS and Compliance Mode Configuration policy.
3. Verify the policy is enabled.

If the policy is not enabled, this is a finding.

4. Verify the following policy options are selected:
- Verify "Require TLS for all connections" is selected.
- From the Security Compliance Mode drop-down, verify "SP800-52" is selected.
- Verify "Full access check and CRL required" is selected.
- Verify "Enable FIPS: is selected.
- From the Allow TLS Servers drop-down, verify the desired port number is entered.
- Verify "TLS 1.2" is selected.
- From the TLS cipher suite drop-down, verify "Select Government (GOV)" is selected.
- From the Certificate Revocation Check Policy drop-down, select the policy required by your Organizational Security Policy.

If any of the policy options noted above are not selected, this is a finding.

Check Content Reference

M

Target Key

5268

Comments