I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not store any critical information. I am thinking that the database server should, at minimum, be behind a 2nd firewall. The DMZ should look like this:
Is this correct or am I over doing and over thinking the protection it needs? Also, should the connection to the web server, database server, and the database server's interfaces be SSL or would it just be SSL between the database server and it's interfaces? I'm always of a mind that more protection is better but am receiving pushback on this and I just want a neutral opinion.