2

According to a TechNet article published by Microsoft, one of its recommendations is to bypass proxies to access Office 365.The basic premise is focused on performance as opposed to security.

Assuming that a proxy is bypassed to access G Suite or Office 365, what are the security pitfalls?

What are the upstream and downstream implications?

For example, does it reduce the ability to determine the internal IP address accessing the site since the address is NAT'ed?

2

The biggest security pitfall is visibility into a major egress window for data. Today we know that over half of all cyber attacks have to do with malicious files and emails, often being sent together in a phishing campaign. Proxies are a wonderful way to tackle parts of this problem.

By sending networked traffic through a proxy we can spot malware coming in and protected data exiting our network. In combination with DLP systems and malware/behavioral analytics network administrators can prevent many unwanted connections from occurring. Without this layer, any encrypted communication becomes unintelligible to the security team. This is not ideal.

Bringing this to Office 365 or GSuite. Both cloud systems are used to send and receive data in a variety of formats from files to emails. As a business, I would not want any of my IP, PII, PHI or other data being extracted through these services except under explicit permission. Likewise, I would not want one of these services to flow into my network as a covert attack channel if we remove the capability to read files coming from the cloud to the data center or end point.

Bypassing a proxy, without other sufficient data controls such as host based DLP or EDR could lead to a major hole in a corporate security net. All it takes is a docx with a malicious macro to start stealing data from your network. Even worse, if the attacker’s determines you can’t read traffic in and out to a cloud system, they will be encouraged knowing you may not detect the data leak at all.

This is not to say proxies are always required. However, they are a significant tool in the defense against data misuse or malware infiltration. Bypassing proxies without sufficient defense against data loss through a cloud service or the inability to track downloaded malware through those services may be a night mare.

In security, visibility can be everything.

  • In the context of services such as G Suite and Office 365, are you able to elaborate on specific security risks? – Motivated Jan 7 at 7:03
  • How have you addressed issues increased latencies when using proxies? – Motivated Jan 7 at 7:21
  • 1
    In the answer or in application? The answer for the practical implementation is it depends. The reality is that everything you introduce between the end user and their chosen destination will increase latency and it's just a matter of life. You can try to increase the number of proxy nodes, but you'll still end up introducing latency. This is where your solution architects need to meet with business and security members to determine what effects the business is willing to stomach in favor of security. – Connor Peoples Jan 7 at 21:48
2

This article is very poorly written.

There are many different types of proxy, and each type of proxy is used for different purposes. The explanation in the article makes sense only for one specific type of proxy: caching proxy.

It's almost always true that dynamic web services don't really benefit much from from caching proxy. Especially for dynamic web services that is already running its static files through a CDN, adding a caching proxy only serves to slow down the service, and possibly causes security issues if the proxy or the web service are misconfigured to allow cache sharing of private contents.

Other than caching proxy the explanation on the article does not really apply to other types of proxies. For pretty much all other types of proxy, like Anonymizing proxy, Data leak prevention proxy, content filtering proxy, data saver proxy, logging proxy, geoblocking avoidance proxy, automated translation proxy, debugging proxy, the argument in the article doesn't apply.

  • What do you mean by dynamic web services? Are you also able to provide a brief description of the other types of proxy and why they would be relevant to the question as this would help answer the pitfalls? – Motivated Jan 7 at 16:01
  • @Motivated Dynamic web services are web services where each pages are personalised for the logged in user or where the data changes so rapidly that caching becomes unnecessary and infeasible. For example, a webmail application, most of the traffic for a webmail is your private data (mailbox), and intermediary caches cannot usefully cache these files. – Lie Ryan Jan 7 at 16:23
  • I presume that caching may not be useful for the example of webmail however proxying is useful for traffic inspection. – Motivated Jan 7 at 16:29
  • @Motivated If you're interested, you can read around Wikipedia or other tech resources about the various types of proxies, it's a very broad topic. However, what the other types of proxies does doesn't really matter for the gist of my answer, the point is that the arguments presented by the article doesn't really apply to any of the other types of proxy. – Lie Ryan Jan 7 at 16:29
  • @Motivated Exactly. Using a caching proxy on top of a service like webmail is mostly just a waste. That doesn't mean that there aren't other reasons people uses proxy, it makes no sense to stop using these proxies due to the arguments in the article. – Lie Ryan Jan 7 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.