{"id":590,"date":"2009-08-28T11:57:54","date_gmt":"2009-08-28T06:27:54","guid":{"rendered":"https:\/\/www.qadit.com\/blog\/?p=590"},"modified":"2009-08-28T12:05:30","modified_gmt":"2009-08-28T06:35:30","slug":"understanding-demilitarized-zone-in-networks","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/understanding-demilitarized-zone-in-networks\/","title":{"rendered":"Understanding Demilitarized Zone in Networks"},"content":{"rendered":"

Demilitarized zone <\/strong>or DMZ<\/strong> as it is abbreviated is a firewall configuration for securing internal network of an organization.In any business environment a need arises to permit external access to some part of organization’s network, for example to enable external e-mail to be received and to provide public access to a web site. This introduces the concept of the “demilitarized zone”.<\/p>\n

The DMZ is a “semi-protected” zone. The DMZ provides a network segment that is externally accessible and which contains services or files that are publicly available. The remainder of the network is placed on a separate network segment and connected to the firewall separately from the DMZ.<\/p>\n

\n

\"dmz\"<\/p>\n

The working of the DMZ can be explained through the following examples:<\/p>\n

Consider Situation 1 with no DMZ<\/strong><\/p>\n

\u2022\tAll the internal servers are located on the same network segment behind a firewall.<\/span><\/strong><\/p>\n

\u2022\tA flaw in any of the internal server software say email server software can be exploited by the hacker to gain access to all other resources located in the same segment.<\/p>\n

Consider Situation 2 with DMZ in place<\/strong><\/p>\n

\u2022\tHere let’s assume that the email proxy server is located in the DMZ. The first firewall may be configured to allow inbound email to access the proxy server which in turn relays the same to the email server located behind the second firewall.<\/span><\/strong><\/p>\n

\u2022\tSince the email proxy server is not on the same network segment as that of the email server, a flaw in the email proxy server software successfully exploited by the hacker cannot be used by the hacker to attack the email server which is protected by the second firewall.<\/span><\/strong><\/p>\n

In simple terms, the idea is that it is better to have a machine hacked on a DMZ than to have a machine hacked on the internal network.<\/span><\/strong><\/p>\n

It is worthy note the following points:<\/strong><\/span><\/strong><\/p>\n

\u2022\tA DMZ should not be connected to the internal network directly; it should be routed through a firewall.<\/span><\/strong><\/span><\/strong><\/p>\n

\u2022\tIt should not contain internal network information such as user IDs or passwords.<\/span><\/strong><\/span><\/strong><\/p>\n

\u2022\tIt should not contain important resources. Files placed in a DMZ should be on read-only mode.<\/span><\/strong><\/span><\/strong><\/p>\n

\u2022\tThe DMZ should be well secured to prevent the hacker from using its resources to attack another organisation’s network.<\/span><\/strong><\/span><\/strong><\/p>\n

\u2022\tThe firewalls should enforce rules to protect the DMZ from the internet and rules to protect the internal network from the DMZ.<\/p>\n

Depending on the level of protection required, multiple DMZs may be deployed.<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

Demilitarized zone or DMZ as it is abbreviated is a firewall configuration for securing internal network of an organization.In any business environment a need arises to permit external access to some part of organization’s network, for example to enable external e-mail to be received and to provide public access to a web site. This introduces … <\/p>\n

Continue reading “Understanding Demilitarized Zone in Networks”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[13],"tags":[68,5,29],"class_list":["post-590","post","type-post","status-publish","format-standard","hentry","category-network","tag-dmz","tag-network-security","tag-qadit"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-9w","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=590"}],"version-history":[{"count":0,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/590\/revisions"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}