You're insightful to point out that the compromise of a single server within a DMZ places all of the other devices...
in that DMZ at risk. However, it's important to point out that the compromise of one system does not necessarily mean that other servers will "automatically" become compromised. When an attacker gains access to a single server, that system does provide a possible foothold in your network. Relying upon the trust relationships between your DMZ's servers, the hacker can then leverage that foothold to gain access to other systems.
How can the enterprise be protected from this risk? By using security controls other than the network firewall that segments the DMZ. For example, deploy host firewall software on each server within the DMZ, restricting inbound traffic to that which is necessary to meet business requirements. These rules should even apply to outside servers that have been collocated in the DMZ. Similarly, implement all of the other system hardening best practices: ensure that systems are patched properly, practice good account management and deploy antivirus and intrusion detection software on the network.
Dig Deeper on Enterprise network security
Related Q&A from Mike Chapple
Explore the differences between wired and wireless network security, and read up on best practices to ensure security with or without wires. Continue Reading
Choosing to encrypt confidential data with AES or DES encryption is an important cybersecurity matter. Learn about the important differences between ... Continue Reading
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ... Continue Reading