SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It only takes a minute to sign up.
Sign up to join this community
We are exploring the possibility of making our Intranet available to our employees outside of our network (and not over VPN). Besides firewalls/forward proxies and such (like the Threat Management Gateway), what other tools are out there to help secure the site and servers from unauthorized access / intrusion?
What do most organizations do for this?
Forefront UAG or TMG are good products for publishing SharePoint externally in a secure manner.
The extent you go to protect your environment depends on your security requirements, but at the least I would suggest placing your externally facing server(s) in an isolated subnet (DMZ). Some organisations go to the extent of creating an external user directory (e.g. an ASP.NET membership store or additional AD).
In past organisations I have also worked with external penetration testing firms to validate infrastructure and application security.
Make the site available over SSL. No point in havign the access to your site in order when anyone can just intercept all the data retrieved by users because the connection to the site they use is not secure.
If you don't want to use SSL to access the site from inside your network, you can use SSL offloading (using TMG or a hardware loadbalancer). This would require you to configure your web app's AAMs (Alternate Access Mappings, which even for me, after 6 years of SharePoint still feel a bit like "Here be dragons" :-D). To learn more about AAM, read the SP Team blog's 3 part blog article "What every SharePoint administrator needs to know about Alternate Access Mappings":
I have known organizations implementing Microsoft Forefront Protection for SharePoint farms.
This gives many awesome security features just for SharePoint sites, like scanning of any files or attachments which are uploaded to the site, which may contain malicious code.