When implementing a firewall, would you recommend placing enterprise users in a DMZ?
No.
DMZs are designed to serve as a neutral location (hence the name demilitarized zone) where public and private services meet. Traditional firewall implementations create three zones: an untrusted zone (typically the Internet, in the case of a border firewall), a trusted zone (the organization's intranet) and a DMZ used to host public services. They're commonly used to provide organizations with a layer of isolation that protects their intranet systems from public exposure.
Enterprise services that must be exposed to untrusted networks, such as Web servers and SMTP servers, should be placed in the DMZ. This arrangement ensures that, in the event of a compromise, internal users and systems have a firewall that protects them from an affected server. Placing enterprise users (who belong on the intranet) in the DMZ eliminates this layer of protection and puts them at risk to systems on the untrusted network.
More information:
A DMZ is necessary for PCI DSS compliance. Read about the regulation's other important control objectives.
Hear security professionals' recommendations on how to implement a DMZ.
This was last published in March 2007
Dig Deeper on Enterprise network security
Examine the important differences between stateful and stateless firewalls, and learn when each type of firewall should be used in an enterprise ...
Continue Reading
Explore the differences between wired and wireless network security, and read up on best practices to ensure security with or without wires.
Continue Reading
Choosing to encrypt confidential data with AES or DES encryption is an important cybersecurity matter. Learn about the important differences between ...
Continue Reading