-11

I recently installed a web proxy at my workplace. I don't understand why, should this be OK? What are the reasons to use a proxy at work? IMO using a proxy at work is a wrong decision.

1
  • 17
    I'd love to know why you'd install something you didn't know the purpose of.
    – womble
    Commented Jul 17, 2011 at 9:55

7 Answers 7

36
  • Caching frequently accessed content
  • Controlling and/or monitoring site access to ensure conformance with internal or external regulations and usage policies
  • Enabling intrusion detection systems and groupware filters to trap viruses or other malicious payloads
1
  • 1
    +1 Pretty much hit the nail on the head. We tend to recommend appliances such as IPCop or pfSense which do more than just proxy. You'll find that with a few addons you can force everything through the proxy and then control (even with time controls) which websites are allowed, banned, etc. You can also easily identify who is working and who is just surfing around all day.
    – KPWINC
    Commented Jun 30, 2009 at 15:56
6

Using a proxy at work is often very much the right decision. Maybe not so much for [very] small companies with not staff and loose policies, but still good for caching at the very least.

Some things already mentioned

  • caching downloaded content, consumes less bandwidth to your ISP
  • content filtering, lets you implement HR policies
  • virus scanning, catches things before hitting client workstations

Some additional things

  • load distribution, allows you to take the load of content filtering, virus scanning, etc off of your primary firewall
  • better security, if you use a web proxy for access control inside of your firewall you can integrate it with your internal authentication mechanisms (AD, LDAP, etc) without having to connect your firewall to do the authentication. Adds another layer between the outside and your internal authentication
  • traffic analysis and usage stats since many [most] firewalls don't log in formats that are recognized by web analytic packages
  • application level protocol filtering (although the gap is closing here), some proxies let you get inside the application level protocol to be able to filter things out more granularly (examples: blocking out WebDAV verbs from an HTTP request, blocking PUTs in FTP)

There are some drawbacks in running a separate web proxy from your primary firewall:

  • Different configurations for apps that use application level protocols other than HTTP, HTTPS, FTP if your proxy doesn't know about them. This is especially apparent in the streaming media arena.
  • You will have a problem with [Java] applets that want to talk directly to their remote hosts outside the realm of HTTP
  • You will need to have a configuration mechanism for client applications (browsers, media players, etc) to use the proxy. This is probably already the case if your Internet connection is coming in to a central location, but for smaller networks where the Internet gateway is the default route this will be an additional configuration to support.
  • It is an additional system to have to support and maintain
2

Because you don't want your developers spending all day on StackOverflow.com :)

1
  • True, luckily our proxies haven't caught on yet :-) Commented Jun 30, 2009 at 18:14
2

Repeat this mantra: "A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface. A single point of Internet access lowers your attack surface."

Otherwise, what everyone else said.

1

One of the reasons to use a proxy at work is so that IT can analyze the traffic going into and out of the proxy for security reasons and to block off certain websites from being accessible via a filter.

0

The proxy "fetches" resources from other servers you have requested, so it serves as a good filter between your network and the Internet. It can speed up access time and keep your machine anonymous.

0

Traffic control, site locks and access control.