What are the risks of placing enterprise users in a DMZ?

A demilitarized zone protects systems from an affected server, but enterprise users themselves should have no place in the DMZ. In this expert Q&A, Mike Chapple explains where they belong.

When implementing a firewall, would you recommend placing enterprise users in a DMZ?
No. DMZs are designed to serve as a neutral location (hence the name demilitarized zone) where public and private services meet. Traditional firewall implementations create three zones: an untrusted zone (typically the Internet, in the case of a border firewall), a trusted zone (the organization's intranet) and a DMZ used to host public services. They're commonly used to provide organizations with a layer of isolation that protects their intranet systems from public exposure.

Enterprise services that must be exposed to untrusted networks, such as Web servers and SMTP servers, should be...

placed in the DMZ. This arrangement ensures that, in the event of a compromise, internal users and systems have a firewall that protects them from an affected server. Placing enterprise users (who belong on the intranet) in the DMZ eliminates this layer of protection and puts them at risk to systems on the untrusted network.

More information:

  • A DMZ is necessary for PCI DSS compliance. Read about the regulation's other important control objectives.
  • Hear security professionals' recommendations on how to implement a DMZ.
  • This was first published in March 2007

    Dig Deeper on DMZ Setup and Configuration



    Find more PRO+ content and other member only offers, here.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.



    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: