Ask the Expert

When should a database application be placed in a DMZ?

I'm working as a volunteer at a government museum. We've developed a database application that is available to our volunteers and staff when working within the Smithsonian Institution network. Now we'd like to also allow our registered users to access it from home so they can do their research there. Is a DMZ the proper place to put the application? If so, should the application only be a read-only copy of the internal interactive application?

    Requires Free Membership to View

There are two interesting security issues within your question: the best network location for the application and the appropriate level of access to grant remote users. You didn't mention anything about the sensitivity of the data included in your database, so I'm going to make the assumption that it's not unusually sensitive.

The placement of the application depends a bit upon the topology of the network. If your organization uses a virtual private network (VPN) and volunteers will be required to connect to the VPN before using the application, place the application's Web front-end in the same location where the VPN terminates. If this is your internal network, it's fine to place the Web front-end there.

If you don't plan to require a VPN connection, however, the DMZ is definitely the right choice, since it ensures that those accessing the application from the public Internet -- including those who attempt to access it without authorization -- won't be able to gain access to other applications or network resources.

The level of access granted to remote users should fall back upon the principle of least privilege; grant them only the access they need to get their jobs done. If there is no business requirement for users to modify data while off-site, there's no need to grant them those permissions. On the other hand, if they do need read access, there are many examples of organizations that expose database-driven applications to external users. Just be sure that you've thought about Web application security as well, since there are a whole other set of concerns involved with properly securing a hosted application.

More information:

  • A member asks Mike Chapple, "Will there be DMZ routing issues if several firewalls serve as the default gateway?"
  • Get the latest DMZ news, tips and expert advice.
  • This was first published in January 2009

    There are Comments. Add yours.

    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: