Good day. I am the IT Manager at work and we are looking to enhance the security of our infrastructure given the sensitive nature of the data we house.
We have a small environment consisting of a few host servers running VMWARE, a dedicated physical backup server, and an enterprise HP SAN, all sitting at a Datacenter.
The consultant we hired as our software developer has been insisting that we need multiple physical firewalls for separation of our environment (proxy accessible to the public, Web app layer, data layer, and development layer (restricted to the other 3 layers)).
I am no network architect but I find it hard to believe that in an era of virtulization we still need physical separation.
As an organization, we need to meet FIPS 140-2 and NIST compliance on our entire architecture and have a small team/budget to make all this happen.
My question is, are 4 physical firewalls needed to provide the security or can this be done virtually in our environment?
One more thing, Cloud services are not an option for us for contractual reasons.