WIXLIB

White PaperCitrix Secure Private Access:A better ZTNA alternativethan Zscaler Private Access.A feature-by-feature comparison.

Citrix Citrix Secure Private Access: A better ZTNA alternative than Zscaler Private Access. A feature-by-feature comparisonWith the recent surge in remote work, IT has beentasked with enabling thousands of remote users withsecure access to applications and data. Rather than afew users accessing the corporate networks via VPN,entire organizations now work outside the office.This has flipped the entire security posture ofcountless organizations.While a few use cases may require traditional VPNsolutions, these are disappearing as applicationsare rebuilt for the web and moved into the cloud.Additionally, in the race to provide remote accessfor employees and contractors, VPN clients are nowrunning on unmanaged and untrusted devices. This hasexposed organizations to many risks, as IT lacks insightinto the health of these devices or the contextualcircumstances of users accessing their networks.Further, VPN solutions are inherently more proneto lateral movement and zero-day attacks.While many organizations still use traditionaltechnologies like VPNs, ZTNA (Zero Trust NetworkAccess) is the most modern choice for secure accessto IT applications. VPNs may still be needed for ITadministrators to manage behind-the-firewall assetssuch as servers and infrastructure systems. However,more than 90% of users do not need VPNs to accesstheir applications and data—and ZTNA is the betterchoice. This means you need the flexibility to moveworkloads off of VPNs at the pace that works bestfor your business.Now that we have established why VPNs should not bethe norm for remote access to enterprise resources,let’s investigate why not every security provider candeliver the comprehensive protection you need.If you’re looking for a Zero Trust Network Access(ZTNA) solution, there’s a good chance you’recomparing Citrix and Zscaler. You may have heardabout exceptional features promised by products likeZscaler Private Access. But do those offerings provideeverything you need to protect against data loss?As you determine which option is the best fit for yourbusiness, it is vital to look at core capabilities. Thispaper discusses why Zscaler Private Access (ZPA)does not fulfill all of the requirements to providesecure and reliable access to all of your applicationsand how Citrix Secure Private Access has an edgefor enabling a VPN-less zero trust architecture.2Choice of connectivity forIT-sanctioned applications Citrix offers multiple options for securing accessto applications, including VDI, DaaS, and VPN. Andwith Citrix Secure Private Access, you’ll have amodern way to provide access to IT applicationsusing a cloud-delivered ZTNA solution. This hidesapplication IP addresses and resources from theInternet, also known as anonymous network. Zscaler offers only one way to access ITsanctioned applications with Zscaler PrivateAccess, which does not cover the entire enterpriseapplication spectrum.Support for Application TypesWeb Applications – Citrix Workspace and ZscalerPrivate Access enable access to on-premises webapplications. These applications are accessible via abrowser, but are not ready to be exposed to the publicinternet as it hosts company confidential data. Citrix Workspace Browser – Citrix Secure PrivateAccess enables IT to apply granular securitycontrols to prevent data exfiltration. Thesesecurity policies regulate user operationsbased on user access context and deviceposture check. They can enforce controls likerestricting copy/paste, printing, downloads, oradding a watermark to the web application. Secure Browser hosted in Citrix Cloud – IT can beconfident that end users can securely navigate theweb with this browser without introducing risk tothe corporate environment. Threats that may beintroduced by visiting malicious websites areisolated off the corporate network and devices.In addition, the browser is discarded at the end ofthe session, ensuring that any malicious softwareencountered while browsing the web never reachesyour infrastructure. Native Browser – Native OS browsers can be usedin clientless scenarios using DNS-managed directconnect capabilities within Citrix Secure PrivateAccess, enabling trusted devices to access internalapplications natively.

Citrix Citrix Secure Private Access: A better ZTNA alternative than Zscaler Private Access. A feature-by-feature comparisonClient/Server Applications - Monolithic andclient-server applications require clients locallyinstalled on the devices. Such applications are tactical,but still tend to serve a critical purpose. Citrix SecurePrivate Access provides Zero Trust Network Access(ZTNA) to all private corporate applications, whetherthese applications are web, SaaS, TCP, UDP, or VDI andvirtual applications, are deployed on-premises or onany public cloud, or accessed from within or fromoutside of the Citrix Workspace App. However,because these applications can also requiresubstantial bandwidth and perform poorlywhen delivered through a ZTNA or VPN,Citrix DaaS may be a better option.Citrix Secure Private AccessZscaler Private AccessCitrix Secure Private Access provides Zero TrustNetwork Access (ZTNA) to all private corporateapplications, whether these applications are web,SaaS, TCP, UDP, or DaaS (Desktop as a Service)and virtual applications, are deployed on-premisesor on any public cloud, or accessed from within orfrom outside of Citrix Workspace.Zscaler Private Access does not offer UDP or aDaaS solution for latency or bandwidth sensitiveapplications that may affect user experience.Native adaptive authentication and access policiesThe way people work is changing, and traditionalsecurity architectures can’t keep up. As your usersbecome more distributed, and as more applications aredelivered from the cloud, you need to protect againstmodern-day attacks looking to exploit applications andAPIs. One of the best ways to strengthen yoursecurity posture is intelligent authentication withmulti-factor authentication (MFA). By continuallymonitoring sessions for anomalous behavior,you can ensure your applications and data staysecure—without compromising the userexperience or hindering productivity.Citrix Secure Private AccessZscaler Private AccessCitrix Secure Private Access features a nativeframework for adaptive authentication. Accessis monitored at the application level based onfactors such as geolocation, device posture,risk profiles, and more.Zscaler Private Access lean heavily on deviceposture and 3rd parties for risk profiles, not offeringconsistent policies across products and services. Asa result, Zscaler Private Access administrators mustcreate and maintain different policies acrossdifferent products.Further, Citrix Secure Private Access adaptiveauthentication provides consistent policiesthat work across ZTNA applications andDaaS (Desktop-as-a-Service) already inuse by Citrix customers.3

Citrix Citrix Secure Private Access: A better ZTNA alternative than Zscaler Private Access. A feature-by-feature comparison4Session securityBoth Citrix and Zscaler offer outbound connectionsand provide network and application isolation. Unlikewhat occurs with VPNs, both Citrix Secure PrivateAccess and Zscaler Private Access do not allow thelateral movement of privilege from one application tothe next. The connection is strictly outbound brokered.However, once an application session is established,Zscaler does not protect corporate data frombeing exfiltrated.Internal web appsSharePointMicrosoftDynamics* 365Your datacenterand clouddeployed appsSecure Private AccessZTNA Authentication and Access PoliciesRoleZero Trust NetworkAccess to ALL ITsanctioned appsRiskLocationClient server / IP-Port groupsCitrix Secure BrowserServiceDeviceSecure access to ITsanctioned apps from BYOand unmanaged devicesBusiness AppsSpecific Business AppsDev tools, servers,code accessCannot be on corporate networkCorporate devicesAgent-less access perferredPublic Cloud Appsand Remote BrowserIsolationAccess from BYO devicesKeylogger and screen capture protectionWith remote work on the rise, people are spendingmore time on public networks and personaldevices—ones that can’t be closely monitored by IT.That makes the risk from devices infected withkeylogger and screen capture malware a constantconcern. To protect against data exfiltration, it’simperative to have a security strategy in place thatspecifically addresses these threats.

Citrix Citrix Secure Private Access: A better ZTNA alternative than Zscaler Private Access. A feature-by-feature comparisonCitrix Secure Private AccessZscaler Private AccessCitrix Secure Private Access offers enforcingcontrols that prevent hijacking of user credentialsor taking screenshots of applications accessedthrough Workspace app using keyloggers andscreen capturing malware. These policies aremainly applicable for unmanaged and BYOdevices that are exposed to anyexternal threats.Zscaler Private Access does not protect againstmalware looking to intercept and steal accessto sensitive information. To protect againstthese threats, you’ll need to buy a completelyseparate service.Enhanced security policies and integrated remote browser isolationAs the use of BYO devices increases, existing solutionslike traditional VPNs fall short. These traditionalremote access technologies don’t provide theprotection you need. Because they requiredevices to be managed at all times, frustrated endusers often go around IT when accessing corporateresources on personal devices.Citrix Secure Private AccessZscaler Private AccessWith Citrix Secure Private Access, granularsecurity policies let you control what users cando within applications based on which devicesthey’re using. For example, you can provide fullfunctionality on corporate-owned devices whiledisabling downloads or the ability to copy andpaste from unmanaged and BYO ones. And withintegrated remote browser isolation technology,users can securely access corporate applicationsfrom unmanaged devices or without a ZTNAplugin. Local sessions are also automaticallyredirected to a cloud-hosted browser, ensuringany malicious code on infected BYO deviceswon’t reach your application workloads.Zscaler Private Access does not includeany in-session security controls apartfrom multi-factor authentication for BYO orunmanaged devices. It also requires a ZTNAplugin to be installed before a user can accesseven browser-based applications. And forgranular security policies, Zscaler will pushyou to buy a completely new service such asZscaler Internet Access, which can be costly.5