A proxy server is a device that sits between the users
and the rest of the network.
This proxy server usually receives requests
from the users, it creates its own request out
to the service on behalf of the users,
receives the response to that request,
and then it usually performs some type of security checks,
and if everything looks good, it provides the answer
to that request to the original user.
This means that the proxy server since it's
sitting in the middle of this conversation
can control quite a bit about these traffic flows.
You can perform caching on the proxy server.
This might be used for access control
so someone would have to put in a username
and password for that request to be sent out of the network,
and this proxy server may provide your URL
filtering or content scanning to be able to keep all of those
in safe.
Some proxy servers are configured
to be explicit this means that we would have
to go into the configuration of each of these user's devices
and tell those devices that our proxy servers located
at a particular IP address and uses a particular port number.
Or the proxy server may be one the users have
no idea exists on the network, no additional configurations
are required.
We refer to these proxies as transparent proxies,
because the end users have no idea
that proxy server sitting in the middle of the conversation.
Although we don't often think of it this way,
if we're doing some type of network address
translation in a router, we're effectively
creating a network level proxy.
But when we refer to proxies on a network,
it's almost always an application level proxy.
The proxy understands exactly how the application operates,
and it's able to create application requests on behalf
of all of the clients.
The proxy you're using may only know
one individual application, perhaps the proxy
is only aware of how HTTP might work,
or maybe it's a proxy that has multiple applications that they
can support, so it might support HTTP, HTTPS, FTP,
and other applications as well.
If you have a proxy in your environment
that is used to control the users access to the internet,
then you're probably using a forward proxy.
Sometimes this is referred to as an internal proxy,
because it's a proxy that's used for your internal users.
Your users would make a request to the proxy
to gain access to a web server on the internet.
The proxy might examine the URL, make sure
that you're not visiting a known malicious site,
because if you are it can block that communication.
There might also be a series of categories associated
with these URLs, so that you can control exactly
what type of content a user might be visiting.
If all of that passes the check, then the proxy
will perform that request for the user,
receive the answer from the internet,
evaluate that information and make
sure it's safe for the user, and then send the user
a copy of that response.
You can also use proxies in the other direction
where users from the internet are hitting
a proxy so they can gain access to internal services
on your network.
We refer to this as a reverse proxy,
and the process is exactly opposite
from what we just described with our forward proxy.
The requests come from users on the internet
into the proxy server.
At this point, the proxy will examine the requests
from the users and make sure that none of the requests
are malicious.
If the requests are valid, it will
send those requests to the web server
and get a response to those requests.
The proxy then receives the answer from the web server
and sends a copy of that answer to the user on the internet.
In some environments, there are very tight security controls.
And one of the ways that people can get around those security
controls is to communicate to a third party proxy that may
be controlled by someone else.
We refer to these as an open proxy,
because these proxies are installed on the internet
for anyone to be able to use.
This is a significant security concern,
primarily because most people are using these proxies
to circumvent existing security controls in their environment,
but we also are concerned about what the proxy may
be doing to the data that's being sent or received
from that proxy server.
It could be that a simple request
is being made by your users to the proxy server, the proxies
then making that request on the users response.
The answer is comings back from the devices on the internet,
but then the proxy may change or add additional code
into the response and send that response to the users.
This might be something very simple like putting
an advertisement on the response that's received,
or the proxy could add malicious code into that software
and send it directly to your users.