<div>
What is the method by which they access Citrix (browser or application)?<br />
<br />
I think the key here would be having an end to end secured connection (like connecting via SSL) because if you aren't connecting via a secure connection there is no way that you can prevent packet sniffing (ie the packets still have to go out and come in). A SSL connection would still allow the information to be &quot;sniffed&quot; but it would be encrypted and absolutely useless to whomever intercepted it.
</div>


<div>
When your users connect back to citrix they should be connecting via a secure connection.<br />
So no matter if they are on an unsecure connection their connection back to the main office will be secure.<br />
As long as you can show that connection is encrypted then you are fine
</div>


<div>
Thank you for the comments. &nbsp;They are connecting to Citirx two ways, one being the Citrix Access Gateway, to view their work desktops within an IE browser window, and the other being the Citrix Program Neighborhood, where our network team has published the 'Windows Explorer' application, thus allowing them to log in, see their network drives, and copy files to and from the laptop.<br />
<br />
So given how we've set them up, is the general consensus that because they are using Citrix (web-based, as well as published application-based) to download and upload files while out in the field, the connection is using SSL, and thus encrypted, so packet-sniffing is not a risk?<br />
<br />
We need to present this explanation to our HIPAA department, so I just want to make sure I'm understanding correctly.<br />
<br />
Thanks so much, to all of you!
</div>


<div>
I assume that Citrix uses SSL, it may not be on by default by I'm sure it can be enabled. &nbsp;But sice you are using the Citrix access gateway My ssumption is SSL is turned on. &nbsp;Yes thi swould create a secure channel and encrypt the traffic, ths satisfying your hippa dept.
</div>


<div>
hereiufund,<br />
<br />
Yes you are understanding correctly, and moorhouselondon's explaination is spot on if they ask the question that he posed.<br />
<br />
Good Luck
</div>


<div>
<div class="content wysiwyg-content">
Hello Experts,<br />
<br />
Our company has several laptops that we're deploying to remote users to take for audits and whatnot. &nbsp;These users will be using various WiFi connections (hotel, restaurant, misc offices, etc) to connect to their network drives via Citrix, as well as to check their email (Outlook Web Access, etc).<br />
<br />
Our HIPAA department wants us to prove that some rogue user will not be able to sit with a packet sniffer, and steal data going over these WiFi connections. &nbsp;They are afraid that someone might be able to steal packets over the air, and thus, obtain SSN's from spreadsheets, and other PHI from emails and whatnot.<br />
<br />
is there a free or inexpensive software solution that can be installed locally on their machines, to prevent someone from sniffing their packets on unsecured wireless networks? &nbsp;I'm open to any other solutions that might work.<br />
<br />
Thank you!
</div>
</div>


Hello Experts,

Our company has several laptops that we're deploying to remote users to take for audits and whatnot.  These users will be using various WiFi connections (hotel, restaurant, misc offices, etc) to connect to their network drives via Citrix, as well as to check their email (Outlook Web Access, etc).

Our HIPAA department wants us to prove that some rogue user will not be able to sit with a packet sniffer, and steal data going over these WiFi connections.  They are afraid that someone might be able to steal packets over the air, and thus, obtain SSN's from spreadsheets, and other PHI from emails and whatnot.

is there a free or inexpensive software solution that can be installed locally on their machines, to prevent someone from sniffing their packets on unsecured wireless networks?  I'm open to any other solutions that might work.

Thank you!

How Can I Prevent Packet Sniffing?

A vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness, known as the attack surface. Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities. Other vulnerabilities include security risks, security defects and constructs in programming languages that are difficult to use properly.

Vulnerabilities

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.

Security

Encryption is the process of encoding messages or information in such a way that only authorized parties can read it. In an encryption scheme, the intended communication information or message, referred to as plaintext, is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients, but not to unauthorized interceptors.