The biggest security pitfall is visibility into a major egress window for data. Today we know that over half of all cyber attacks have to do with malicious files and emails, often being sent together in a phishing campaign. Proxies are a wonderful way to tackle parts of this problem.
By sending networked traffic through a proxy we can spot malware coming in and protected data exiting our network. In combination with DLP systems and malware/behavioral analytics network administrators can prevent many unwanted connections from occurring. Without this layer, any encrypted communication becomes unintelligible to the security team. This is not ideal.
Bringing this to Office 365 or GSuite. Both cloud systems are used to send and receive data in a variety of formats from files to emails. As a business, I would not want any of my IP, PII, PHI or other data being extracted through these services except under explicit permission. Likewise, I would not want one of these services to flow into my network as a covert attack channel if we remove the capability to read files coming from the cloud to the data center or end point.
Bypassing a proxy, without other sufficient data controls such as host based DLP or EDR could lead to a major hole in a corporate security net. All it takes is a docx with a malicious macro to start stealing data from your network. Even worse, if the attacker’s determines you can’t read traffic in and out to a cloud system, they will be encouraged knowing you may not detect the data leak at all.
This is not to say proxies are always required. However, they are a significant tool in the defense against data misuse or malware infiltration. Bypassing proxies without sufficient defense against data loss through a cloud service or the inability to track downloaded malware through those services may be a night mare.
In security, visibility can be everything.