Ivanti Connect Secure (ICS): Next-Gen Security and Scalability

Ivanti Connect Secure (ICS)

NIST / FIPS 140-3: Certified with Oracle Linux 9 by using OpenSSL.org's FIPS provider/module in ICS 25.x (25.1.0.0 or later) Cert #4779

Ivanti Secure Access Client (ISAC) for Windows

NIST / FIPS 140-3: Certified with Oracle Linux 9 by using OpenSSL.org's FIPS provider/module in ICS 25.x (25.1.0.0 or later) Cert #4779

Ivanti Secure Access Client (ISAC) for MacOS

NIST / FIPS: 22.8R5 or later based on openSSL.org Cert #4985

ISAC Mobile - iOS, Android

NIST / FIPS: 22.8R5 or later based on openSSL.org Cert #4985

Oracle Linux 9 OS

Whitepaper:
The Role of Operating Systems in IT and Security Strategy

• Greater memory support: 64-bit OS can address more memory (RAM), enabling Connect Secure to handle larger datasets and more simultaneous users
• Increased security: 64-bit user space enhances protection against memory-based attacks
• Improved performance: Applications can leverage 64-bit processing power, resulting in faster data processing, higher throughput, and better overall performance
• Enhanced scalability: Supports larger database sizes, more connections, and resource-intensive applications, making it suitable for enterprise-scale workloads

• Futureproofing and compatibility: Newer Oracle features and software updates are optimized for 64-bit platforms, ensuring ongoing compatibility and support for a wide variety of 3rd party software libraries

SELinux

• Provides fine-grained, mandatory access control that dramatically limits potential damage from compromised applications or processes, even if such processes run as root.
• Enabled in enforcement mode by default in ICS.

NGINX with integrated Web Application Firewall (WAF) configuration for ICS gateways

• Inspects and stops Layer 7 (application) attacks over HTTP traffic terminating on Connect Secure gateways
• Prevents attacks such as SQL injection, cross-site scripting (XSS), and other web exploits

• Minimizes attack surface

Key Management

• Unique, randomized keys for every gateway
• Utilizes TPM/vTPM (Trusted Platform Module) implementation for robust key management

• Enhances security by minimizing risk of breach
• Reduces impact of key compromise
• Prevents sensitive data leakage / compromise
• Elevates security posture

Secure Boot / Factory Reset

• Provides enhanced integrity checks at boot time to thwart low-level malware persistence
• Ensures integrity of critical file systems remains intact during factory reset for ISA hardware devices and VMs running ICS software images
• Incorporates Trusted Platform Module (TPM)

• Protects integrity of boot process by verifying an established chain of trust
• Extends chain of trust validations to additional file systems, further safeguarding their integrity
• Prevents loading of low-level malicious code from boot partitions
• Prevents attacker persistence at low level files systems
  Enhances security by reducing risk of compromise

Secure Boot / Factory Reset - Virtual Appliances

• Ensures only trusted and verified code runs at startup with secure boot implementation for virtual appliances.
• Validates firmware and OS integrity during boot.
• Utilizes vTPM (virtual Trusted Platform Module)

• Virtual appliances include all hardware appliance secure boot and factory reset features, plus…
• Safeguards systems from tampering, unauthorized changes, or malware injection
• Ensures trusted execution across virtual appliances

Root Privilege Avoidance (NRP)

• System processes are denied full administrator rights by default, and are run with the least privileges required, for example, as unprivileged or dedicated service accounts

• Limits access to only the required files and system resources
  Limits attack surface
  Reduces risks and limits potential harm

Debug Web Server Logs

• Provide debug severity codes for web-related events

Multi-factor Authentication (MFA)

• Requires users to provide two or more independent methods of verification to access an account or system
  Enhances security by making it much harder for unauthorized users to gain access, even if they have obtained a password

Run External Integrity Checker Tool (ICT)

• Scans from nSA to single or multiple gateways with a single click.
• Security utility designed to verify the integrity of key files and system components
• Detects unauthorized changes, corruption, or tampering

• Aids in identifying potential compromises or anomalies by comparing files against known good baselines
• Enables faster response to threats and maintaining system trustworthiness
• Provides an alert if there is an anomaly in the executed ICT on a gateway
• Enables admins to select a version-specific ICT package, execute against one or multiple ICS gateways, and view the results on the same page where the ICT is executed

Advanced HTML5 Feature License Management

• Managing HTML feature licenses brings cost, legal, security, and operational benefits
• Enables organizations to control and audit the web technologies available to users or developers.

Alerts and Notification Enhancements

• Email-based alerts provide ICS gateway status

Desktop and Mobile Platform Support

• Desktop - Windows (Intel x86 and ARM), macOS (Intel and ARM) M1/M2/M3/M4, Linux
  Mobile - iOS, Android, Android App on ChromeOS

Fully Qualified Domain Name (FQDN) Split Tunneling

• Enables users to securely access specific resources over VPN (based on domain names, not just IP addresses)
• Allows other internet traffic to route directly (outside the VPN)

• Improves network efficiency and resource utilization
• Reduces VPN bandwidth usage
• Enhances user experience by routing only necessary traffic through the secure tunnel

Fast Identity Online (FIDO2) and Passwordless Authentication

• Provides more secure and friendly authentication without passwords
• Utilizes passkeys, biometrics, PINs

Run External Integrity Checker Tool (ICT)

• Scans from nSA to single or multiple gateways with a single click
• Security utility designed to verify the
  integrity of key files and system components
• Detects unauthorized changes, corruption,
  or tampering

• Aids in identifying potential compromises or anomalies by comparing files against known good baselines
• Enables faster response to threats and maintaining system trustworthiness
• Provides an alert if there is an anomaly in the executed ICT on a gateway
• Enables admins to select a version-specific ICT package, execute against one or multiple ICS gateways,
  and view the results on the same page where the ICT is executed

Advanced HTML5 Feature license Management

• Managing HTML feature licenses brings cost, legal, security, and operational benefits
• Enables organizations to control and audit the web technologies available to users or developers.

Alerts and Notification Enhancements

• Email-based alerts provide ICS gateway status

Layer 3 VPN

• Dual-transport (SSL + Encapsulating Security Payload) full Layer 3 VPN connectivity with granular access control.
• "Always-on VPN with Lockdown Mode" and "VPN Only Access" modes for Compliance (VPN connection automatically connects/disconnects based on user's location).

• Machine-based VPN with ability to step up to user-based authentication after user log-in.

• "On Demand VPN" and "Per App VPN" for seamless and secure end-user experience.

Layer 4 VPN

• Client/server proxy application that tunnels traffic from specific applications to specific destinations.
• Windows version of the Secure Application Manager (PSAM) enables secure traffic to individual client/server applications and application servers.

• The Java version of the Secure Application Manager (JSAM) provides support for static TCP port client/server applications.

Conditional Access

• Validates and verifies devices and users via a set of automated policies to protect networks and data. Each access attempt is evaluated dynamically and controlled in real time based on the policies in effect.

Advanced User Portal
(Layer 7/Clientless VPN)

• Secures clientless access from any HTML5-capable browser to published and/or user-added applications and links. Dynamically generated based on user role.
• RDP/VNC/SSH access with Advanced HTML5.
• Web rewriter and web proxy built in.

• Multi-portal support (e.g., SSO portal for employees, 2FA portal for contractors).

• Support for Windows Terminal Services, VDI (Citrix, VMware) and File Browsing.

Optimized end-user experience

• Smooth roaming from remote access to local LAN access (Ivanti Policy Secure).
  Single Sign On (SSO) for rapid, secure access from remote or on-site locations (via integration with Ivanti Connect Secure and Ivanti Policy Secure).

Stateful endpoint integrity and assessment

• Assesses and remediates end-user devices prior to authentication with easy policy definitions.
  Windows, MacOS, Apple iOS and Android.

Flexible launch options
(standalone client, browser-based launch)

• Users can easily launch SSL VPN via their web browser or directly from their devices.
• Auto Connect feature allows devices to automatically connect to VPN, either when the machine starts or user logs on.

• VPN on demand feature leverages OS capabilities for auto triggering VPN seamlessly in the background when an approved application needs corporate access.

Supports Cloud Secure Solution

• Blend cloud and data-center access into a seamless user experience for next-generation workers.
• Add compliance rules for hybrid DC access.

Pre-configuration options
(Windows and Mac only)

• Administrators can pre-configure a deployment with a list of gateways for end users to choose.

Authentication options

• Adaptive Authentication using dynamic, multi-factor authentication using several user attributes.
• Administrators can deploy Ivanti for remote user authentication using a wide array of authentication mechanisms, including biometric authentication support with Windows Hello for Business, hardware token, smart card, soft token, Google Authenticator, one-time passwords and certificate authentication.
• Administrators can send AAA traffic via a desired interface (internal / external / management) to delegate user authentication to an Identity Provider.

• OAuth/OpenID Connect support allows integration with any standard OpenID Provider like Google, OKTA, Azure AD, etc., while connecting to Connect Secure (acting as Relying Party).
• OAuth group-based role mapping enables access policies and user roles to be assigned based on identity provider group membership.

VDI support

• Ivanti supports the latest versions of VMware Horizon and Citrix XenApp / XenDesktop.

Granular SSL Cipher Configuration

• Enables the administrator to select specific ciphers over those pre-configured for highly secure compliance.

REST API

• Comprehensive REST APIs support automation, diagnostics, configuration management, and operational workflows.
• Postman collection of ICS Rest APIs is available via download portal.

Secure Boot with Trusted
Platform Module (TPM)

• Enhanced integrity checks at boot time to thwart low-level malware persistence
• Utilizes unique and random encryption key at instance level
  Hardware appliances have integrated TPM chip

• Virtual appliances use virtual TPM from underlying cloud/hypervisor platform

ACME (Automated Certificate Management Environment )

• Supports the reduced TLS Baseline Requirements which has shortened both the lifetime of TLS certificates and the reusability of CA-validated information in certificates

• Automates the certificate requests, domain validation, certificate issuance, and certificate deployment on the designated interface.

Dynamic role mapping with custom expressions

• Combines network, device and session attributes to determine which types of access are allowed
• A dynamic combination of attributes on a per-session basis can be used to make the role-mapping decision.
• Through MDM integration, fetches device attributes and applies policy decisions appropriately before granting access.

• Enables the administrator to provision by purpose for each unique session.

Support for RSA Authentication Manager

• RSA Authentication Manager risk-based authentication.

• Provides another authentication layer option.

Standards-based built-in Time-based
One-Time Password (TOTP)

• Enables multi-factor authentication using smartphones.

• Leverages smartphones to roll out a cost-effective and self-service two-factor authentication mechanism, where one-time passcodes are generated by a mobile app.

Multiple sessions per user

• Allows remote users to launch multiple remote-access sessions.

• Enables remote users to have multiple authenticated sessions open at the same time, such as when accessing VPN from a laptop and a smartphone simultaneously.

User record synchronization

• Supports synchronization of user records such as user bookmarks across different Ivanti Appliances.

• Ensures a consistent experience for users who often travel from one region to another and therefore need to connect to different Ivanti Appliances running Ivanti Connect Secure.

Mobile-friendly SSL VPN login pages

• Provides predefined HTML pages that are customized for mobile devices, including Apple iPhone, iPad and Google Android.

• Provides mobile device users with a simplified and enhanced user experience and web pages customized for their device types.

Integration with strong authentication and identity and access management
(IAM) platforms

• Ability to support SecurID, Security Assertion Markup Language (SAML) including standards-based SAML v2.0 support and public key infrastructure (PKI)/digital certificates.
• OAuth/OpenID Connect Support.

• Leverages existing corporate authentication methods to simplify administration.

Neurons for Secure Access

• Optional centralized management, analytics and reporting platform for Ivanti Connect Secure deployments.
• Full configuration management, one-click upgrades, centralized logging, custom reporting and troubleshooting.
• "Lift and shift" configurations through configuration templates and multi-node configuration management.

• Centralized configuration and gateway lifestyle management saves time and money.
• Enhanced behavioral analytics identify and automatically act on risky user behavior before it becomes a problem.
• Simplifies management of multi-node or global deployments.

Mobile Device Management (MDM) integration

• Enables consolidated reporting and dashboards for simplified management.
• Leverages MDM attributes for more intelligent and centralized policy creation.
• Facilitates transparent "no touch" MDM-based deployment of Ivanti Clients to iOS and Android devices.

• Extends MDM investments to gain comprehensive endpoint visibility and support additional mobile use cases.

Bridge Certification Authority (BCA) support

• Bridge CA is a PKI extension that cross-certifies anchors (Root CAs).
• Supports federated PKI deployments with client certificate authentication.
• Enables customers to configure policy extensions in the admin UI, to be enforced during certificate validation.

• Enables customers who use advanced PKI deployments to deploy Ivanti Appliances to perform strict standards-compliant certificate validation before allowing data and applications to be shared among organizations and users.

Multiple hostname support

• Ability to host different virtual extranet websites from a single appliance.

• Eases management overhead.

Customizable user interface

• Creation of completely customized sign-on pages.

• Provides an individualized look for specified roles, streamlining the user experience.

SAML single sign-on for cloud and web applications access

• SAML 2.0-based SSO to a variety of web applications, including many of today's most popular Software as a Service (SaaS) applications.
• Includes SSO functionality, even when connecting via an Ivanti Connect Secure Layer 3 VPN tunnel.
• Ivanti Connect Secure supports deployments as both a SAML Identity Provider (IdP) and as a SAML Service Provider (SP).

• Single sign-on to a user's web and cloud-based applications, simplifying the user connectivity experience.

Kerberos Constrained Delegation

• Support for Kerberos Constrained Delegation (KCD) protocol.
• Enforces KCD for Exchange Active Sync traffic, requiring client certificates, trusted CA certificates and proper delegation policies for authentication.

• Eliminates the need for companies to manage static passwords, reducing administration time and costs.

Kerberos SSO and NT LAN Manager
(NTLMv2) support

• Ivanti Connect Secure will automatically authenticate remote users via Kerberos or NTLMv2 using user credentials.

• Simplifies the user experience by eliminating their need to enter credentials multiple times to access different applications.

Password management integration

• Standards-based interface for extensive integration with password policies in directory stores (LDAP, AD and others).

• Leverages existing servers to authenticate users.
• Users can manage passwords directly through the Ivanti Connect Secure interface.

Web-based SSO basic authentication and NTLM

• Enables users to access other applications or resources protected by another access management system without re-entering login credentials.

• Alleviates the need for users to enter and maintain multiple sets of credentials for web-based and Microsoft applications.

Web-based SSO forms-based, header variable-based, SAML-based

• Ability to pass username, credentials and other customer-defined attributes to the authentication forms of other products and as header variables.

• Enhances user productivity and provides a customized experience.

OAuth/OpenID Connect

• OAuth/OpenID Connect support enables integration with any standard OpenID Providers like Google, Okta, Azure AD, etc., while connecting to Connect Secure (acting as Relaying Party).

• Integrate into existing OAuth deployments for easy user ID federation.

Ivanti Secure Access Client

• Unified, integrated, remote access client that can also provide LAN access control and dynamic VPN features to remote users.

• Ivanti Secure Access Client replaces the need to deploy and maintain multiple, separate clients for different functionalities such as VPN and LAN access control.
• End users simply "click and connect" the connection they need.

Clientless core web access

• Secure access to different types of web-based applications, including today's most common applications such as Outlook Web Access, SharePoint and many others.
• Remote Desktop Protocol (RDP) access in Ivanti Connect Secure can be delivered over HTML5, via third-party RDP.

• Provides the most easily accessible form of application and resource access from a variety of end-user devices with extremely granular security control options.
• Completely clientless approach using only a web browser.

IKEv2 support for mobile devices

• Enables remote users to connect from any mobile device that supports Internet Key Exchange (IKEv2) VPN connectivity.
• Administrator can enable strict certificate or username/password authentication for access via IKEv2.

• Full L3 VPN support for new devices that support IKEv2 but for which a client is not yet available.

Virtual Desktop infrastructure (VDI) support

• Allows interoperability with VMware View Manager and Citrix Xen Desktop.

• Provides remote users seamless access to their virtual desktops hosted on VMware and Citrix servers.

Zero Touch Provisioning

• Deploy ICS using OpenStack KVM, VMWare, Hyper V and cloud (GCP, Azure, AWS).
• Obtain initial configuration from local DHCP server without manual data entry.
  Configure and manage via REST API.

• Enhances admin productivity and provides a customized experience.

ActiveSync Proxy

• Provides secure access connectivity (strong encryption + certificate
  authentication) from mobile devices (such as iOS or Android) to the Exchange Server via proxy, with no client software installation. Enables up to 5,000 simultaneous sessions.

• Enables customers to allow many users (including employees, contractors and partners) to access corporate resources through mobile phones via ActiveSync.

Secure Application Manager (SAM)

• A lightweight application download enabling access to client/server applications.

• Enables access to client/server applications using just a web browser.
• Also provides native access to terminal server applications without the need for a preinstalled client.