ICAP and the Proxy

For IT administrators, the proxy is a well known part of the network infrastructure. Admins use the proxy to secure their end-user's access to web sites on the Internet, and they expect the proxy to provide access restrictions and logging based on the websites visited. Today proxies do more than ever before.

With the introduction of ICAP (Internet Content Adaptation Protocol) based on RFC 3507 (2003), proxies gained the ability to provide even more significant security functions. ICAP specifically has been implemented with proxies for anti-virus scanning (including malware scanning), URL filtering, and for DLP/ILP (Data Leakage Protection/Information Leakage Protection) scanning.

ICAP allows the proxy to talk to a secondary device, using policy to decide what needs to be sent to the secondary device for filtering/scanning. For example an administrator can create a policy on a proxy to have all file attachments sent to the ICAP server for anti-virus scanning. This is useful where end-users have access to webmail on the Internet, and are downloading files from the email service. Any other files downloaded from the web can be targeted for malware scanning as well.

In the DLP/ILP scenario, a policy for any files uploaded to a webmail service could be implemented to allow for the search of any proprietary or confidential information in the uploaded file.

One of the biggest benefits of ICAP, is the standards based nature of the protocol, allowing the administrator to choose from a variety of vendors for anti-virus, URL and DLP/ILP solutions that can integrate with their proxy. These new tools for the proxy let the IT administrator keep web browsing safe for their end-user in a age when more threats than ever are showing up on web pages.

In The News: Web Forums Hijacked to Spread Child Porn

The above is an older article from June of 2007, but I thought it was a good article to highlight the spread of attacks on websites, even you would not expect an attack on. Hackers attacked and infiltrated well-known sites, including ones that are for kids, inserting links to pages that contained pornography.

This is a good reminder to make sure the web security proxy you're using for your organization's access to the internet has the ability to look at embedded links and rate them separately from the main page. That way your users still get the content they're looking for and you get to block out the malicious content that was inserted by hackers.

In The News: Web Porn at Work

The news article above outlines one Japanese worker who surfed porn at work and was undetected for quite some time. It was not until his computer picked up a virus from one of the sites he was surfing that his extensive browsing was discovered.

Wouldn't you hate to have been the IT administrator of that network, having to explain why you didn't detect this waste of bandwidth earlier? Or even simpler, why such an abuse of corporate policy was allowed without detection.

The web proxy would have been the simplest network device to have implemented, to enforce policy, or at the very least categorize web browsing into reports for management to see where traffic was going and from which IP addresses. It's incredible to think that with the network tools available today, we still hear stories like this one.

Secure Computing Stumbles

Contrary to all my predictions about the proxy returning to the spotlight as the focus of security for the enterprise, Secure Computing seems to be having problems selling their web security solutions, according to the Motley Fool article linked above.

According to the article growth for Secure has slowed from an anticipated 20% down to a mere 2%. Motley Fool goes on to suggest the economy is to blame for Secure's woes, but then corrects itself by indicating other security vendors (proxy, anti-virus and other), don't seem to have a problem with the economy. That said, is web security still where the focus needs to be for the IT administrator?

In my opinion, undoubtedly. There's still way too many threats on the web, with more being reported everyday. When reputable web sites like the New York Times and the United Nations are being infiltrated with malware, there's no telling which site is truly safe to browse.

You certainly don't want to be the IT administrator who has no response, when asked, "what did you do to prevent that latest outbreak from a web site's drive-by malware download?". Be proactive, and at the very least be able to show you've put some web security in place in your corporate proxy.

Mash Up?

You may have been hearing the term "mashup" more and more when referring to web pages and websites. But what's the implication for the IT administrator, the end-users and the security proxy?

First we have to talk about what a "mashup" refers to. A mashup web page is when a web page or web application delivers content on demand that is a combination of different mediums and applications. The wikipedia link above to the definition of mashup uses the example of when google maps are used in a real estate page to build a full page combining not only map data, but photos, video and other information for the end-user. The key here is personalized content.

That's great for the end-user. It means getting better information, quicker than ever before. But it may become the IT administrator's nightmare. The biggest problem with the mashup is that the old web security technologies in proxies may not be able to recognize the threats that come in the form of a mashup. URL databases that do web crawls may not necessarily get the same information that the end-user gets, because the personalized content will be delivered based on the end-user's history with the website, something the web crawler won't have.

As the web becomes more and more dynamic the old URL databases and database filtering will become less and less relevant for companies that are trying to enforce web access policies. A company with a policy against pornography in the workplace, may find it more and more difficult to enforce this policy with just URL database filtering. More and more, it will be necessary to evaluate web pages real-time based on actual content being delivered to the end-user and the need to evaluate embedded URL's in delivered content. An embedded URL in a mashup needs to be evaluated independently of the web page, as it can come from anywhere in the world wide web. Unfortunately web reputation is going to be less and less important as more well known websites get infiltrated.

What does all of this mean for the IT administrator? It means ensuring they have the latest security tools in their proxy's arsenal. Real time virus scanning, real time URL categorization, and embedded URL checking are just a few of the technologies the IT administrator needs to be looking for in their proxy. It's going to be important to keep track of new technologies as they evolve and make sure they get deployed successfully after a reasonable testing phase.

Everything Old is New Again

When the web started out it was quickly recognized that there was a need to protect and secure the web space as well as expand the capacity of the web. The proxy quickly became the source of that expansion capacity as a web cache, and working in tandem with the corporate firewall, providing the security that IT administrators were looking for in logging and controlling access to the internet.

The focus of security quickly shifted from the web proxy to email in the new millennium, as viruses and worms were quickly propagated using email transmission. Edge email gateways became the hot product and Ciphertrust and Ironport became the "in" products to have.

As hackers start to realize that organizations have the email problem mostly in-hand, the threat vector has started to shift back to the web again. We're seeing more and more "drive-by" downloads of spyware and viruses on web pages, even well known and reputable web sites.

While the proxy may trigger up memories of days gone by, it's going to take its place in days to come as well. The proxy is ideally suited to handle web threats, and every organization needs to start taking threats from the web seriously, as seriously as e-mail borne viruses if not more seriously, as few end-users today consider the web a source of threats.

Defining the Line Between Good and Bad

As the IT administrator, you probably don't want to be tasked with setting the policy for what's allowed in the workplace. Unfortunately, in many cases the IT administrator has to make the decision as to how to interpret a vague or non-existent HR policy on what's permittable on the corporate network.

There's some obvious categories that should be blocked from the corporate network. Prevent malware, spyware and viruses, and implement tools and protection to that end. Next obvious is probably pornography, for all sorts of reasons, a sexual harassment lawsuit being the most convincing. After those two categories, everything else is probably more of a gray area if no one in your HR organization has already defined a policy.

The URL database vendors for proxies have made it easy to get specific websites categorized into these different buckets, and the proxy makes it relatively simple to setup policy to block the unwanted categories. That leaves the categories that are sort of in between. Is it acceptable to go shopping on company time? For the administrative assistant that's probably a yes, if he or she is going to the office supply store's website to order items for the office. But do other employees really need to be browsing Ebay during working hours?

How about a sports website? Perhaps if you work for ESPN or Sports Illustrated, that makes sense, but the typical office worker probably doesn't need access to those sites. And there's the hard call for the IT administrator. Should they be the arbiter in deciding what's allowed?

With some proxies, the IT administrator doesn't need to make that decision. Anything the IT administrator decides is in a gray area, can be put into a policy that displays a warning page when that type of site is visited. For example, if an employee visits Ebay, a guidance page that displays verbiage stating the site is a "shopping" site can be displayed, and warn the user that it may not be within the parameters of their job to visit such a site, that their visit will be logged, and if they want or need to, they can visit the site by clicking through the warning page. The benefit of this "guidance" page is that it leaves the decision about whether an employee can visit a page to the employee and not to the IT administrator.

If you're an IT administrator lucky enough to have policy set by the HR department that is clear, a good proxy, can also let you configure the policy to do whatever has been decided in the policy. Perhaps it's not okay to visit sporting sites during the day from 8 to 5, but outside of that time, there's no restriction on those sites. Perhaps the executives on management row don't have any restrictions on where they can browse, but everyone else does. These should be policies that your proxy lets you set. The proxy should be a tool in the IT administrator's arsenal, and one that helps keep the administrator out of the HR policy setting process.