Connection Proxy is a system that relays communications between two endpoints instead of allowing direct contact. It can conceal the real source or destination of traffic, which attackers use for command relay, pivoting, or disguise. Defenders should inventory proxies, restrict unauthorised relays, and inspect unusual forwarding paths.
How a Connection Proxy Works
A connection proxy sits between two endpoints and relays traffic on their behalf. That indirection changes the trust boundary, because the endpoints no longer communicate directly and the proxy can observe, forward, filter, or reshape the path between them.
In practice, proxies are used for routing, policy enforcement, anonymity, monitoring, and protocol mediation. The same property that makes them useful, controlled intermediation, also makes them attractive when an actor wants to mask where traffic is really coming from or going to.
Why Connection Proxies Matter to Security
Connection proxies matter because they can hide origin, collapse multiple sessions into one visible source, and create a layer that defenders must trust and inspect. That makes them relevant in both defensive architectures and adversary tradecraft.
For defenders, the key question is whether the proxy is authorised, inventoried, and constrained to approved use cases. Unauthorised relays can become a blind spot, especially when they are used to move traffic across segments that would otherwise be separated by policy.
For attackers, a proxy can support command relay, pivoting, or disguise by making the real endpoint harder to trace. MITRE ATT&CK Enterprise Matrix is useful for mapping those relay, lateral movement, and evasion patterns to adversary behaviour.
Common Uses and Misuses of Connection Proxies
Legitimate proxies are common in enterprise networks, application delivery, secure access, and privacy-preserving architectures. They can centralise inspection, standardise egress, and abstract internal topology from external clients.
Misuse usually appears when a proxy is treated as a neutral pipe rather than a security control with ownership, logging, and scope limits. A proxy that can forward anything, anywhere, may quietly become a transit point for unauthorised administration, data exfiltration, or covert command traffic.
That is why proxy inventory and path review are part of sound network control, not just hygiene. NIST Cybersecurity Framework 2.0 supports this kind of governance by framing asset visibility, protective controls, and continuous detection as linked responsibilities.
How to Assess and Control Proxy Exposure
Exposure review starts with knowing which systems can act as proxies, what traffic they are allowed to relay, and whether those routes match intended architecture. An internet-reachable proxy, an internal proxy with broad forwarding rights, and a temporary support relay all carry different risk.
Inspect forwarding paths for unusual destination sets, unexpected hop chains, or traffic that should not traverse a shared relay. Strong proxy control also depends on authentication, least privilege, audit logging, and segmentation so that a relay cannot silently become a bridge across trust zones.
Controls from NIST SP 800-53 Rev 5 Security and Privacy Controls are relevant here, especially where access control, auditability, and configuration management need to constrain proxy behaviour.
Risk and Threat Considerations
Connection proxies create a meaningful risk when they are deployed without tight governance, because they can hide the true source, destination, or operator of traffic. That makes them attractive for covert relay, staging, pivoting, and persistence, especially when defenders do not monitor nonstandard forwarding paths.
Failure mechanism: An attacker abuses an authorised or rogue proxy to route malicious traffic through a trusted intermediary, reducing visibility and complicating attribution, filtering, and containment.
Impact: Organisations can lose detection coverage over command-and-control paths, internal lateral movement, or exfiltration routes, and incident responders may need to treat the proxy itself as a compromised or suspect asset.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Connection proxies directly support relay, pivoting, and traffic concealment. |
| Recommendation — Map observed relays to T1090 and hunt for staging, pivoting, and covert forwarding activity. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Proxy exposure control begins with knowing which relays exist and where they sit. |
| DE.CM-01 — The organization monitors networks and network services for potential cybersecurity events | Unusual proxy forwarding paths require continuous monitoring for anomalous network activity. | |
| Recommendation — Inventory all proxy-capable systems and review their approved forwarding scope. Monitor proxy traffic for unusual destinations, hop chains, and forwarding patterns. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Proxies mediate network flows and should enforce approved communication paths. |
| AU-2 — Event Logging | Proxy activity needs auditable records to support detection and investigation. | |
| Recommendation — Enforce approved flow paths so proxies cannot relay traffic outside policy. Log proxy sessions and forwarding decisions for review and incident response. | ||
Practitioner Guidance
What to watch for: Treat unexplained forwarding behaviour, new proxy endpoints, and traffic that bypasses normal egress or segmentation policy as signals for immediate review. The main judgement is whether the relay exists for a documented business reason and whether its scope still matches that reason.
Governance implication: Ownership should be explicit, because proxies often sit at the intersection of network, security, and platform teams. If no one owns the relay policy, logging quality, and approval path, the proxy can become an ungoverned transit layer rather than a controlled control point.
Related resources from NHI Mgmt Group
- Why do connection reuse and proxy translation create extra risk for HTTP request smuggling?
- What happens when teams use a proxy for the Realtime API instead of a direct connection?
- When is a reverse proxy better than a VPN for access control?
- What is the difference between a managed gateway and a reverse proxy in front of a gateway?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org