Communication between VDA and Delivery Controller. How are you handling VDA-to-DDC communication for security audits? It feels like a contradiction: Citrix claims Port 80 with WCF is a "Security Best Practice," but auditors reject it because it lacks full TLS (Transport Layer Security). https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/2507-ltsr/secure/best-practices#communication-between-vda-and-delivery-controller Are you sticking with the default, or have you been forced to move everything to Port 443 with TLS to satisfy modern compliance?

Auditor is dumb. Port 80 with WCF is enough.

To a standard IT admin, Port 80 with WCF Message Security seems "fine" because the payload is encrypted. However, for a high-level attacker or a security auditor, this configuration is a major finding due to Information Leakage and Lack of Transport Integrity. 1. Metadata Exposure (Traffic Analysis) WCF only encrypts the SOAP Body. The HTTP transport layer remains in plain text. • The Leak: An attacker using a sniffer (Wireshark) can see HTTP headers: POST /Citrix/BrokerAgent, SOAPAction: "RegisterVda", and the Host header. • The Risk: This provides a perfect map of your infrastructure. The attacker knows exactly where the Brokers are, what API versions you run, and the frequency of registrations—all without breaking a single bit of encryption. 2. Absence of Perfect Forward Secrecy (PFS) This is the "kill switch" for Port 80 in modern audits. • WCF/Kerberos: Relies on static Machine Account passwords from Active Directory (changed only every 30 days). If an attacker records your traffic today and compromises the Domain Controller/Machine Hash a month later, they can retroactively decrypt the entire recorded history. • TLS (Port 443): Uses Diffie-Hellman ephemeral keys. Each session has a unique, one-time key that is destroyed immediately after. Even if the server certificate is stolen later, the past traffic remains undecipherable. 3. Direct Parser Exposure (The "Front Door" Problem) • Port 80: Every packet (including malicious ones) hits the http.sys driver directly. If there is a Zero-Day vulnerability in the Windows HTTP stack (like a Buffer Overflow), an attacker can strike the OS with a single malformed packet. • Port 443: TLS acts as a Pre-authentication Shield. The attacker must complete a cryptographic handshake before any HTTP data is even looked at by the system. If they don't have a trusted certificate (in mTLS) or a valid handshake, the malicious payload never reaches the vulnerable OS components. 4. Session Integrity & Injection On Port 80, the TCP stream is vulnerable to Packet Injection. An attacker can inject TCP RST packets or spoofed HTTP 503 errors to force "Registration Storms," effectively DDoSing your Delivery Controllers. TLS ensures Stream Integrity; any modification to a single bit causes a checksum failure and safely drops the connection. The Verdict WCF Message Security protects the data, but TLS protects the infrastructure. Relying on Port 80 in 2026 ignores the Zero Trust principle, leaving your transport layer, your metadata, and your historical data vulnerable to sophisticated persistence attacks.