In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.
I have four DMZs at my current job (using a sidearm setup), and this is smaller than my past implementations. These are always built in a top down security approach - a higher security box always reaches into the DMZ and pulls out the necessary bits of information it needs or pushes the bits which need to be publicly accessible.
I totally get the idea of stopping and analyzing the traffic before it goes on to an internal potentially squishy system. The language in use implies punching holes in the opposite direction. It also implies the use of an analysis engine within the DMZ.
Maybe what I don't get is how the term DMZ is being used. The functions outlined sound much more like what is done with an application level firewall:
Termination of IP connections at the DMZ provides opportunity for inspection and restriction of source/destination, and/or inspection / blocking of content, thus preventing unfiltered access between untrusted and trusted environments. Termination of IP connections both inbound and outbound provides opportunity for inspection and restriction of source/destination, and/or inspection / blocking of content, thus preventing unfiltered access between untrusted and trusted environments. This helps prevent, for example, malicious individuals from sending data they've obtained from within your network out to an external untrusted server in an untrusted network.
These descriptions sound exactly like what TMG does out of the box.
Taking this literally, I would have a second TMG box sitting inside the DMZ being provided by my first TMG box.. That just sounds nuts to me. It sounds like the standard was written for an older setup, something like having a PIX blocking all traffic and bouncing everything through a second server running something like ISA / Forefront that sits inside the DMZ.
As far as I can figure there would be no security benefit of having a separate box in the DMZ for this use my configuration, other than if I have an Apache box outside and IIS inside (or visa versa).
Please provide some insight as to how or why terminating these connections in a DMZ instead of within the firewall itself would be beneficial. I'm just not seeing it.