I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the DMZ(Demilitarized Zone) and application servers/DB will be inside the WAN. But the client is insisting on keeping an application server running out in the DMZ.
We know that its a security risk but we are not able to back ourselves by putting solid points across .
The questions I have are,
- would exposing just 80 or 443 still compromise the security?
- Can a hacker push bots or take control of the server and in turn reach the internal network?
- What kind of security measures need to be taken given this approach?
Note: We are using Windows servers.