I recently installed a web proxy at my workplace. I don't understand why, should this be OK? What are the reasons to use a proxy at work? IMO using a proxy at work is a wrong decision.
Using a proxy at work is often very much the right decision. Maybe not so much for [very] small companies with not staff and loose policies, but still good for caching at the very least.
Some things already mentioned
- caching downloaded content, consumes less bandwidth to your ISP
- content filtering, lets you implement HR policies
- virus scanning, catches things before hitting client workstations
Some additional things
- load distribution, allows you to take the load of content filtering, virus scanning, etc off of your primary firewall
- better security, if you use a web proxy for access control inside of your firewall you can integrate it with your internal authentication mechanisms (AD, LDAP, etc) without having to connect your firewall to do the authentication. Adds another layer between the outside and your internal authentication
- traffic analysis and usage stats since many [most] firewalls don't log in formats that are recognized by web analytic packages
- application level protocol filtering (although the gap is closing here), some proxies let you get inside the application level protocol to be able to filter things out more granularly (examples: blocking out WebDAV verbs from an HTTP request, blocking PUTs in FTP)
There are some drawbacks in running a separate web proxy from your primary firewall:
- Different configurations for apps that use application level protocols other than HTTP, HTTPS, FTP if your proxy doesn't know about them. This is especially apparent in the streaming media arena.
- You will have a problem with [Java] applets that want to talk directly to their remote hosts outside the realm of HTTP
- You will need to have a configuration mechanism for client applications (browsers, media players, etc) to use the proxy. This is probably already the case if your Internet connection is coming in to a central location, but for smaller networks where the Internet gateway is the default route this will be an additional configuration to support.
- It is an additional system to have to support and maintain
Repeat this mantra: "A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface."
Otherwise, what everyone else said.