What are the risks of placing enterprise users in a DMZ?
A demilitarized zone protects systems from an affected server, but enterprise users themselves should have no place in the DMZ. In this expert Q&A, Mike Chapple explains where they belong.
When implementing a firewall, would you recommend placing enterprise users in a DMZ?
No.
DMZs are designed to serve as a neutral location (hence the name demilitarized zone) where public and private services meet. Traditional firewall implementations create three zones: an untrusted zone (typically the Internet, in the case of a border firewall), a trusted zone (the organization's intranet) and a DMZ used to host public services. They're commonly used to provide organizations with a layer of isolation that protects their intranet systems from public exposure.
A DMZ is necessary for PCI DSS compliance. Read about the regulation's other important control objectives.
Hear security professionals' recommendations on how to implement a DMZ.
Enterprise services that must be exposed to untrusted networks, such as Web servers and SMTP servers, should be placed in the DMZ. This arrangement ensures that, in the event of a compromise, internal users and systems have a firewall that protects them from an affected server. Placing enterprise users (who belong on the intranet) in the DMZ eliminates this layer of protection and puts them at risk to systems on the untrusted network.
More information:
This was last published in March 2007
