You're insightful to point out that the compromise of a single server within a DMZ places all of the other devices...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
in that DMZ at risk. However, it's important to point out that the compromise of one system does not necessarily mean that other servers will "automatically" become compromised. When an attacker gains access to a single server, that system does provide a possible foothold in your network. Relying upon the trust relationships between your DMZ's servers, the hacker can then leverage that foothold to gain access to other systems.
How can the enterprise be protected from this risk? By using security controls other than the network firewall that segments the DMZ. For example, deploy host firewall software on each server within the DMZ, restricting inbound traffic to that which is necessary to meet business requirements. These rules should even apply to outside servers that have been collocated in the DMZ. Similarly, implement all of the other system hardening best practices: ensure that systems are patched properly, practice good account management and deploy antivirus and intrusion detection software on the network.
Related Q&A from Mike Chapple
Web application firewalls may be a way to better security, but organizations need to be aware of the compliance implications of WAFs.continue reading
An SEC report shows over three-quarters of financial institutions were subject to at least one cybersecurity attack. Expert Mike Chapple looks at ...continue reading
The Data Accountability and Trust Act is likely to become a law this year. Expert Mike Chapple advises organizations on how to prepare.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.