What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)?
I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I know that you would add a computer which hosts services to the DMZ e.g. web server, to increase security (if your web server gets attacked, then your internal network will be safe). I have seen proxy servers in some business which are placed on the internal network and not the DMZ.
"Proxy server" is an imprecise term. You have to think about what the proxy server is protecting to determine where it fits on the network.
For example, web proxy servers used to channel outbound web surfing are often placed on internal networks rather than DMZs - their connections are outbound and they pose no additional "threat" to the internal network - an internal user doesn't gain anything by attacking it in order to leverage its access; they're already internal.
On the other hand, application proxy servers which accept traffic initiated from the Internet and heading inbound are usually placed in a DMZ. The assumption is that a connection initiated by an attacker could somehow breach the software on the proxy - a buffer overflow, for example - and that once that happens the attacker can use the proxy as a hopping-off point. Such a proxy is kept in the DMZ to limit the damage a successful breach of that first layer can cause.
