How does F's Citrix-based thin-client design (step 2) work, and what does it gain in security?
The finance client software now runs on Citrix servers in the data centre; users connect from their PCs with Citrix client software and use the finance client inside a virtual desktop. Firewall 1 allows only the Citrix servers to reach the Unix cluster (protocol fclient), firewall 2 allows only the office clients to reach the Citrix servers (protocol ICA). The result is a multiple perimeter security.
* Two perimeters in a row: the legacy protocol never leaves the data centre, and the office only speaks Citrix's protocol. *
The gains:
- The outdated protocol and technology stay inside the data centre. The old
fclientprotocol now runs only between Citrix server and cluster, behind firewall 1. - Centrally managed virtual desktop with data-centre security. The client software is installed and patched once, on servers in a protected room, not on hundreds of PCs.
- A then state-of-the-art client protocol. Between office and data centre only ICA (Citrix's remote-display protocol) runs.
- No application data on the client. The PC only receives screen updates and sends keystrokes and mouse input.
A practical note: Citrix renames its products very often (Citrix Virtual Apps was formerly WinFrame, MetaFrame, Presentation Server and XenApp), so the case speaks only of "Citrix server" and "Citrix (thin) client".
Go deeper:
Citrix Virtual Apps — Wikipedia (German) — the product and its many historical names.- Citrix — the vendor's site, for the current product names.
- Thin client — Wikipedia — a client that only displays what a server computes.