I used to work for a Government client, that had a similar request. I tried to reason with them, but to no avail. After extensive discussion, we agreed that they didn't really want full security. They only wanted the appearance of security. They wanted me to make the lives of any data-stealer as hard as possible.
This is possible. I carried out the following steps:
- I then had the bright idea of blocking all the requests, and white-listing only the required requests. This was achieved by having a HTTP Proxy in on the web-facing webserver, which re-routed the requests to the ArcGIS server, which was on the internal LAN.
- The REST Services Directory was Disabled from the REST Admin
- The URLS were changed from the standard ArcGIS REST format. For example
- Upto the extent possible, we cached the services, and used the cache directly
- The hits to the Query Tasks were logged, and monitored.
Was all of this worth it? Maybe. The client was happy and we got paid. But it did take away my time from implementing actual features in the WebGIS. It also made my life very difficult while developing, since there were several bugs in the Proxy, which didn't work right the first time around.
And at the end of, when we looked at the few open services that we had, I had to ask myself why they were spending so much money on ArcGIS server. We could have achieved all that using a tilecache and some Php services to query the database.