The STA runs on the controller and is embedded within the Citrix XML service. The STA issues session tickets in response to the connection requests for published resources. The STA is simply used to validate user sessions and session requests. It does not perform encryption or validate packet integrity. For these types of security, you need to use SSL.