Security and ICAP

Security risks with ICAP

As with any client-server interaction, the link between the NetCache appliance and the ICAP server must be guarded for both privacy and security. Ensure that the network between the NetCache appliance and the ICAP server is at least as secure as the network between the user's browser and the NetCache appliance. The reason is that the current release of ICAP can expose some private data that NetCache security features strive to protect.

Recommendations for security and privacy protection

Network Appliance recommends that you employ the following security measures for ICAP server deployment with a NetCache appliance:

Deploy the ICAP server and the NetCache appliance on a private network, ideally a nonbroadcast network and possibly a switched hub network.
Deploying the ICAP server and the NetCache appliance on the same network has the added advantage of improving performance.
Do not share the NetCache password.
Take security precautions appropriate to the operating system and applications running on the ICAP server computer.
Locate the ICAP server and the NetCache appliance in a secure computer room.
One concern is that a small change to the ICAP server could redirect HTTP traffic to a remote hostile server. For this reason, the ICAP server should receive the same level of security protection as the NetCache appliance.

ICAP services are not invoked with secure sockets transactions

NetCache cannot monitor transactions made through the secure sockets layer (SSL). SSL is designed to prevent a "man in the middle" attack on an HTTP transaction. Because RSA public-key cryptography is used to encode secure sockets transactions, only the origin server can decode the contents of a secure sockets transaction.

NetCache will proxy all inbound and outbound transactions that are made through SSL. If the browser indicates that it is ready to set up a secure connection (for example, when a user is ready to start a financial transaction), and the user agrees to the secure connection, ICAP services will not be invoked for subsequent transactions.

If you want virus checking over HTTP to be secure, do not allow downloading of any executable files through SSL. The reason is that a virus might pass through the NetCache appliance when ICAP services are not invoked. The virus could infect a local computer system.

Note
The only way to enforce a policy whereby executable files are not downloaded through secure sockets is to block the SSL port and disable CONNECT requests.

For more information about SSL, go to the following URL: http://developer.netscape.com/tech/security/ssl/howitworks.html.