Demilitarized zone (computing)
computer security, a demilitarized zone (DMZ), based on military usage of the term but more appropriately known as a demarcation zone or perimeter network, is a physical or logical subnetworkthat contains and exposes an organization's external services to a larger, untrusted network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network(LAN); an external attacker only has access to equipment in the DMZ, rather than the whole of the network.
In a network, the hosts most vulnerable to attack are those that provide services to users outside of the LAN, such as
ervices that belong in the DMZ
Generally, any service that is being provided to users in an external network should be placed in the DMZ. The most common of these services are web servers, mail servers, ftp servers and DNS servers. In some situations, additional steps need to be taken to be able to provide secure services.
Web servers may need to communicate with an internal database to provide some specialised services. Since the database server is not publicly accessible and may contain sensitive information, it should not be in the DMZ. Generally, it is not a good idea to allow the web server to communicate directly with the internal database server. Instead, an
application servercan be used to act as a medium for communication between the web server and the database server. This may be more complicated, but provides another layer of security.
Because of the confidential nature of e-mail, it is not a good idea to store it in the DMZ. Instead, e-mail should be stored on an internal e-mail server. The mail server in the DMZ should pass incoming mail to the internal mail server and the internal mail server should pass outgoing mail to the external mail server. Ideally, all communications should be initiated by the internal mail server.
For security, legal compliance and also monitoring reasons, in a business environment, it is also recommended to install a proxy server within the DMZ. This has the following benefits:
* Obliges the internal users (usually employees) to use this particular proxy to get internet access. The users should not be allowed to browse internet directly and bypass the DMZ defenses.
* Allows the company to save on internet bandwidth because some of the web content may be cached by the proxy server.
* Allows the system administrator to record and monitor user activities and make sure no illegal content is downloaded or uploaded by the employees. In many EU countries for example, a company director is liable for employees' internet activities.
Reverse proxy servers
A reverse proxy server provides the same service as a proxy server, but the other way around. Instead of providing a service to internal users, it provides indirect access to internal resources from external network (Usually the internet).A back office application access, such as an email system, can be provided to external users (To read emails while outside the company) but the remote user does not have direct access to his email server. Only the reverse proxy server can physically access the internal email server. This is an extra layer of security, which is particularly recommended when internal resource needs to be accessed from the outside. Usually such reverse proxy mechanism is provided by using an
application layer firewallas they focus on the specific shape of the traffic rather than allowing traffic through by the mean of a TCP/UDP port such as a classic firewall.
There are many different ways to design a network with a DMZ. Two of the most basic methods are with a single firewall, also known as the three legged model, and with dual firewalls. These architectures can be expanded to create very complex architectures depending on the network requirements.
A single firewall with at least 3 network interfaces can be used to create a network architecture containing a DMZ. The external network is formed from the
ISPto the firewall on the first network interface, the internal network is formed from the second network interface, and the DMZ is formed from the third network interface. The firewall becomes a single point of failure for the network and must be able to handle all of the traffic going to the DMZ as well as the internal network.
A more secure approach is to use two firewalls to create a DMZ. The first firewall (Also called "front-end" firewall) must be configured to allow both traffic destined for the DMZ as well as traffic for the internal network. The second firewall (Also called "back-end" firewall) must be configured to only allow traffic destined for the internal network that is originating from the DMZ. The first firewall must be able to handle a much larger amount of traffic than the second firewall. It is recommended to use 2 different vendors. If an attacker manages to break the first firewall defense, it will take him even more time to break the second one if it is different. This architecture is more costly, but the increased protection may offset cost.
Some home routers refer to a DMZ host. A home router DMZ host is a host on the internal network that has all ports exposed, except those ports forwarded otherwise.By definition this is not a true DMZ (Demilitarized Zone), since it alone does not separate the host from the internal network. That is, the DMZ host is able to connect to hosts on the internal network. However, hosts within a real DMZ are prevented from connecting with the internal network by a firewall that separates them, unless the firewall permits the connection. A firewall may allow this if a host on the internal network first requests a connection to the host within the DMZ.
Eric Maiwald. Network Security: A Beginner's Guide. Second Edition. McGraw-Hill/Osborne, 2003.Internet Firewalls: Frequently Asked Questions, compiled by Matt Curtin, Marcus Ranum and Paul Robertson
Wikimedia Foundation. 2010.
Look at other dictionaries:
Demilitarized zone — DMZ redirects here. For other uses, see DMZ (disambiguation). This article is about the military term. For the computer networking term, see DMZ (computing). The Vietnamese Demilitarized Zone separated North Vietnam and South Vietnam. In military … Wikipedia
DMZ (computing) — In computer security, a DMZ (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization s external services to a larger untrusted network, usually the Internet. The purpose of a DMZ … Wikipedia
DMZ — DeMilitarized Zone (Computing » Networking) * De Militarized Zone (Governmental » Military) * Divide Memory by Zero (Computing » Assembly) * Dead Man s Zone (Governmental » Military) * Decentralized Machine Zone (Computing » Networking) … Abbreviations dictionary
List of Internet topics — This page is a list of Internet topics. AlphanumericTOC align=center nobreak= numbers= externallinks= references= top=| A Abilene Network Ad hoc network Address resolution protocol Aggregator (news aggregator) ADSL AirPort All your base are… … Wikipedia
Bastion host — A bastion host is a special purpose computer on a network specifically designed and configured to withstand attack. The computer hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the… … Wikipedia
WDMZ — Wireless DeMilitarized Zone (Computing » Networking) … Abbreviations dictionary
DMZ (disambiguation) — DMZ stands for demilitarized zone, a buffer zone between military powers. DMZ may also stand for: DMZ (computing), a demilitarized zone in network computing DMZ (Korea) or Korean Demilitarized Zone, the demilitarized zone between North and South… … Wikipedia
Abkürzungen/Computer — Dies ist eine Liste technischer Abkürzungen, die im IT Bereich verwendet werden. A [nach oben] AA Antialiasing AAA authentication, authorization and accounting, siehe Triple A System AAC Advanced Audio Coding AACS … Deutsch Wikipedia
Liste der Abkürzungen (Computer) — Dies ist eine Liste technischer Abkürzungen, die im IT Bereich verwendet werden. A [nach oben] AA Antialiasing AAA authentication, authorization and accounting, siehe Triple A System AAC Advanced Audio Coding AACS … Deutsch Wikipedia
Liste von Abkürzungen (Computer) — Dies ist eine Liste technischer Abkürzungen, die im IT Bereich verwendet werden. Inhaltsverzeichnis A B C D E F G H I J K L M N O P Q R S T U V W X Y Z siehe auch: Liste von Dateiendu … Deutsch Wikipedia