We are bringing up a server that will be exposed to the Internet from a vendor who's application has no official vendor front end server.
Although this web application server will pull data from internal sql resources, I'm concerned there is a chance this server could be compromised.
When I asked them about the security of this, they said if I wanted I could simply put a reverse proxy like NGINX in front of it.
We already have load balancers that I'm planning on using. Is it acceptable to simply put this server behind load balancers which basically are reverse proxies to begin with, or should one do load balancers and nginx (ie a double reverse proxy?)
The application server is a web product that will serve up on ports 80 and 443. Technically, the ssl will live on the balancer.
This got me thinking too, our modern day exchange mail servers webmail does not have an official Microsoft front end either for webmail. Microsoft doesn't make such a product.
Is the days of DMZ over in favor of other multi layer security offerings?