I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) architecture and an three tier architecture (presentation -> logic -> data zones).
Their argument is that I should be fine with firewall -> F5 with ASM -> firewall -> Presentation/Logic/data layer all in one zone. Their argument is that this is a two tiered architecture so should count to meet my requirement. I've asked them to find me an industry standard document explaining security design this way and have been stonewalled -- probably because there are not any.
I'm having difficulty explaining that the first thing a hacker from the internet touches should be dead ended and prevent north-south movement into the next zone. They want it in terms of architectural capabilities.
An ideas on how to explain a two tier application security design architecture in terms of architectural capabilities? Any other ideas would be helpful too.