Protect Your Web Applications

McAfee

Mar 24, 2015

2 MIN READ

Reverse proxies are critical to shield Web apps from external attacks.

Many organizations today are concerned about how to safely provide customers, employees, and vendors access to their Web applications safely. They need to protect their internal assets against external malware attacks. Every day we read new horror stories in the press about hackers who use phishing emails and drive-by malware downloads to steal money, identities, and sensitive internal documents.

Blocking this type of attack requires a combination of technologies. Email protection software is the key technology to help protects users against phishing emails, while a traditional Web gateway acts as a proxy to protect endpoint systems from malware, sites with poor reputations, and unauthorized exfiltration of protected content.

These tools generally protect against attacks launched against your end users. Conversely, if you need to provide a Web service to external users such as customers or business partners, how do you protect that system against attack?

To do that, you need a reverse proxy.

In a typical reverse proxy configuration, the proxy intercepts Web traffic that an external user is attempting to upload. At this point, complete malware scanning and even DLP rules can be applied to protect the company from both malicious files and incidental private user data being uploaded inadvertently. The proxy only allows clean data in, while blocking attacks, malware, and suspicious data.

In certain use cases, it may make sense to configure the Web server to use an application using the Internet Content Adaptation Protocol (ICAP) to redirect traffic to a separate malware scanning device for analysis. The ICAP scenario enables the Web server to treat the incoming content with greater flexibility.

Whether you chose a reverse proxy or the ICAP route, your organization enjoys multiple benefits:

You can securely expose internal enterprise applications to users outside of the corporate network without the need for a VPN.
You can authenticate user identity and apply authorizations before granting access to the Web server.
You can dynamically distribute the workload of a large user environment across multiple servers.
You can offload CPU-intensive tasks, optimizing Web server performance.

Using this type of configuration improves overall security, while allowing those outside the firewall who require access to critical applications to get it. Productivity is enhanced, without jeopardizing security.

View the original post on Dark Reading.