Reverse proxies are critical to shield Web apps from external attacks.

Rees Johnson, Sr. VP and GM the Content Security Business Unit, Intel Security

March 23, 2015

2 Min Read

Many organizations today are concerned about how to safely provide customers, employees, and vendors access to their Web applications safely. They need to protect their internal assets against external malware attacks. Every day we read new horror stories in the press about hackers who use phishing emails and drive-by malware downloads to steal money, identities, and sensitive internal documents.

Blocking this type of attack requires a combination of technologies. Email protection software is the key technology to help protects users against phishing emails, while a traditional Web gateway acts as a proxy to protect endpoint systems from malware, sites with poor reputations, and unauthorized exfiltration of protected content.

These tools generally protect against attacks launched against your end users. Conversely, if you need to provide a Web service to external users such as customers or business partners, how do you protect that system against attack?

To do that, you need a reverse proxy.

In a typical reverse proxy configuration, the proxy intercepts Web traffic that an external user is attempting to upload. At this point, complete malware scanning and even DLP rules can be applied to protect the company from both malicious files and incidental private user data being uploaded inadvertently. The proxy only allows clean data in, while blocking attacks, malware, and suspicious data.

In certain use cases, it may make sense to configure the Web server to use an application using the Internet Content Adaptation Protocol (ICAP) to redirect traffic to a separate malware scanning device for analysis. The ICAP scenario enables the Web server to treat the incoming content with greater flexibility.

Whether you chose a reverse proxy or the ICAP route, your organization enjoys multiple benefits:

  • You can securely expose internal enterprise applications to users outside of the corporate network without the need for a VPN.

  • You can authenticate user identity and apply authorizations before granting access to the Web server.

  • You can dynamically distribute the workload of a large user environment across multiple servers.

  • You can offload CPU-intensive tasks, optimizing Web server performance.

Using this type of configuration improves overall security, while allowing those outside the firewall who require access to critical applications to get it. Productivity is enhanced, without jeopardizing security.

About the Author(s)

Rees Johnson

Sr. VP and GM the Content Security Business Unit, Intel Security

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of malware penetration into corporate networks.  For the last decade, Rees' responsibilities included  increasing detection effectiveness as the Senior Vice President of PM for McAfee Labs, doubling the IPS revenue as the GM of the Network Security Business Unit, and running the worldwide product management team.  

Rees joined McAfee in 2003 through the acquisition of Entercept (HIPS) where he ran product management and the Cisco OEM.  Entercept, led the market in preventing zero-day attacks and blended threats on the host. Rees began his career at Accenture building enterprise applications for several of the world's largest telecommunication companies.  Rees has 20 years of enterprise software experience and holds an MBA from the Wharton School of Business with majors in finance, strategic management, and information systems

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights