I see many disscussions about DMZ and many configurations (some are for real experts and some for one WAN 2 pc Where is the point of using "Unified Threat Management"
Seconding what Barry said, isolation and defense in depth.
The same reason we isolate Guest WiFi from the rest of the network, why we isolate Management and SAN traffic from the regular LAN. Keeps the un-wanted's out. [:)]
Stuff like the WAF and proxies just add more defenses at the perimeter, making it harder to compromise public facing servers. The DMZ ensures that when (not 'if') a compromise happens, the compromised machine can't be used to break into protected systems on the LAN.
Some organizations take that a step further and firewall between the servers and the workstations, so that if an internal workstation is compromised, it can't affect the servers.
Seconding what Barry said, isolation and defense in depth.
The same reason we isolate Guest WiFi from the rest of the network, why we isolate Management and SAN traffic from the regular LAN. Keeps the un-wanted's out. [:)]
Stuff like the WAF and proxies just add more defenses at the perimeter, making it harder to compromise public facing servers. The DMZ ensures that when (not 'if') a compromise happens, the compromised machine can't be used to break into protected systems on the LAN.
Some organizations take that a step further and firewall between the servers and the workstations, so that if an internal workstation is compromised, it can't affect the servers.
