What are the reasons to use a web proxy at work?

Question

I recently installed a web proxy at my workplace. I don't understand why, should this be OK? What are the reasons to use a proxy at work? IMO using a proxy at work is a wrong decision.

Answer 1

• Caching frequently accessed content
• Controlling and/or monitoring site access to ensure conformance with internal or external regulations and usage policies
• Enabling intrusion detection systems and groupware filters to trap viruses or other malicious payloads

Answer 2

Using a proxy at work is often very much the right decision. Maybe not so much for [very] small companies with not staff and loose policies, but still good for caching at the very least.

Some things already mentioned

• caching downloaded content, consumes less bandwidth to your ISP
• content filtering, lets you implement HR policies
• virus scanning, catches things before hitting client workstations

Some additional things

• load distribution, allows you to take the load of content filtering, virus scanning, etc off of your primary firewall
• better security, if you use a web proxy for access control inside of your firewall you can integrate it with your internal authentication mechanisms (AD, LDAP, etc) without having to connect your firewall to do the authentication. Adds another layer between the outside and your internal authentication
• traffic analysis and usage stats since many [most] firewalls don't log in formats that are recognized by web analytic packages
• application level protocol filtering (although the gap is closing here), some proxies let you get inside the application level protocol to be able to filter things out more granularly (examples: blocking out WebDAV verbs from an HTTP request, blocking PUTs in FTP)

There are some drawbacks in running a separate web proxy from your primary firewall:

• Different configurations for apps that use application level protocols other than HTTP, HTTPS, FTP if your proxy doesn't know about them. This is especially apparent in the streaming media arena.
• You will have a problem with [Java] applets that want to talk directly to their remote hosts outside the realm of HTTP
• You will need to have a configuration mechanism for client applications (browsers, media players, etc) to use the proxy. This is probably already the case if your Internet connection is coming in to a central location, but for smaller networks where the Internet gateway is the default route this will be an additional configuration to support.
• It is an additional system to have to support and maintain

Answer 3

Because you don't want your developers spending all day on StackOverflow.com :)

Answer 4

One of the reasons to use a proxy at work is so that IT can analyze the traffic going into and out of the proxy for security reasons and to block off certain websites from being accessible via a filter.

Answer 5

Repeat this mantra: "A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface."

Otherwise, what everyone else said.

Answer 6

The proxy "fetches" resources from other servers you have requested, so it serves as a good filter between your network and the Internet. It can speed up access time and keep your machine anonymous.

Answer 7

Traffic control, site locks and access control.