As web technologies became more and more popular,
we found that we needed some way to scale these web
servers that we were using.
When you go to google.com, you don't go to a single server.
Google obviously has hundreds and hundreds, and perhaps even
thousands of Google servers out there
that we are connecting to at any particular time.
So out there on the network, you're
usually hitting something like a load balancer.
There's many ways to distribute load across different servers.
A load balancer is a very, very common way
to do that when you're in a data center.
It's usually a piece of hardware that is in the rack,
and it's connecting to four different servers
in my particular picture, but it can be many, many more servers
on the network.
The load balancer receives the request from your browser,
and it distributes the loads evenly, usually,
across these servers.
You can decide how exactly you'd like to distribute that load,
and it really is distributing across what
we call a cluster of different servers.
The idea is that I don't really care
which server I'm connecting to.
All four of those servers are exactly the same.
When I hit a web page.
I just want to be able to have the accessibility to the web
page, and by distributing that load across them,
we can be assured that we've got some uptime and availability
that we are happy with.
We don't want things slowing down so
much that we don't want to use that web server.
Obviously you're going to need this
in a really large environments, because usually you've
got thousands and thousands of people connecting
to your website all at the same time.
The load balancers become very, very important
in those environments.
And you can distribute based on the load,
you can distribute based on what content.
Maybe one of these servers provides images,
another one provides video, another one
provides the web page itself.
You can decide exactly how to separate the load across those.
This creates a little bit of a security challenge for us,
because you have all of these people coming into the load
balancer.
You want to be sure that it's being distributed across all
those servers, are all of the servers updated with the latest
security patches?
Are there vulnerabilities that have not
been addressed on the different servers.
They are different machines, so it becomes very important
that you keep all of them updated to the latest security
patches.
And of course, you want to be sure there's no security
issues by using the load balancer itself.
Somebody was to find an exploit that
would manipulate how the load balancer worked,
it could essentially send the data somewhere else
other than your web server, and you certainly
don't want that to happen, either.
Another very common security technology
that we use to protect their end users
from bad things on the internet is a proxy.
A proxy is a server or series of servers
that's designed to sit right in the middle of your users
and the big, bad internet, and its job
is to take any requests the user's sending out to a web
server and stop it, and then send the request on its behalf.
So what will happen is you'll be on your machine,
you'll need to go to Google, and you'll send your request.
And instead of it getting out to Google, your proxy server
sitting in the middle, it says wait, hold on,
before you can go to Google, I'm going to stop you right there,
and I'm going to find out what you need and ask Google myself.
And a proxy server makes the request to Google
and receives the response.
The proxy server then looks at the data
and makes sure there's nothing bad inside of there.
There's no malware, there's no viruses.
Usually makes sure that the user's even
allowed to use Google itself, and if it likes the results,
it will then send the answer back down to the end user.
So it's an extra step between you and the internet,
and there's some performance requirements there.
Obviously sitting in the middle and stopping
everybody's internet connection requires
that that proxy server be pretty beefy.
Able to handle a lot of different connections
and a lot of bandwidth going across the internet.
Proxy servers are also very useful for caching.
If I'm going to a website and I'm downloading a big file,
and the next person on the internet
does exactly the same thing, proxy servers
are often configured to cache information.
And so if they see a second request come through,
they can simply send that information directly
to the second user, and they don't
have to make that request back to the internet.
And therefore the results are getting a lot faster
to the end users, and there's a lot of bandwidth
we also did not have to use to go out to the internet.
So some nice performance increases
if the proxy server is doing caching.
There's two ways to really configure
the way that your systems use the proxy server
if a proxy server is an explicit proxy,
and that is one where you must configure
your browser and your other applications
to know that the proxy's there, and to use the proxy.
Then you'll need to make sure you
make those changes in your browser,
or you need to make sure as a security administrator
that you're finding an automated way to make
those changes inside people's browsers,
and of course any other application that
needs to access the internet.
There's also another type of proxy
you can choose to use called a transparent proxy.
That means you don't have to configure anything
for your end users.
You don't have to change any of the settings in your browser,
you don't have to change settings on your third party
apps, but sometimes applications will not work properly
through a transparent proxy.
The proxy is still proxying, and so there
are changes being made to the network communication,
so not all applications work very well
with explicit proxies or transparent proxies.
And from a security perspective, it
becomes a bit of a challenge for us.
If not all applications can use a proxy,
and yet the proxy is the primary way
that we provide additional security to the internet,
then maybe we're opening ourselves up,
because we end up having to make exceptions
for certain applications.
And any time you make an exception
in a firewall, any time you make an exception in a proxy,
you're opening a little bit of a window there for bad things
to occur.
So that's the balancing act you have
to make as a security professional.
Do you use a proxy to provide a little bit more security,
or do you provide a different methodology
to allow filtering to and from the internet?
There's a number of options available.
Proxies is simply one of many that you can choose from.