Perimeter and Protocol Security

A demilitarized zone, or DMZ, is a network segment that sits between an organization's trusted internal network and the untrusted public internet, hosting the systems that must be reachable from outside — web servers, mail servers, public-facing DNS servers — while keeping them isolated from the internal network where sensitive data lives. A common design uses two firewalls: an outer firewall filtering traffic arriving from the internet into the DMZ, and an inner firewall filtering traffic passing from the DMZ into the internal network, so even if an attacker compromises a server inside the DMZ, a second control still stands between that foothold and the organization's core systems. A simpler single-firewall design, sometimes called a three-legged configuration, achieves a similar separation using one device with three network interfaces. The underlying principle in either case is the same one behind segmentation generally: a public-facing service is, almost by definition, more exposed to attack than an internal one, so it should never sit on the same network segment as the systems an organization most needs to protect.