2

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How and where would you place the database server. In the DMZ, or allow database connections through the DMZ firewall back to the internal network where the database server is housed.?

What if this database server needs to be accessed also from internal users, eg maybe they need to query who has registered at the website..etc.. How would you design where to place this DB server? thanks

Improve this question

2 Answers 2

Reset to default
3

For a reasonable level of security, the answer is really neither. The database should be housed in it's own zone, not the DMZ with the web server, or in the internal network zone. This allows additional levels of protection both against intrusion from the public Internet should the web server or web application be compromised, and against attacks from the internal network which are a very real problem. It also offers a defense in depth mechanism to protect the internal network should an attacker who penetrates the DMZ figure out how to piviot into the DB zone...While they own the DB at this point, you don't want to them to own the internal network as well.

So, something like this:

enter image description here

Improve this answer
0
1

Ideally the application would be written to conform to a 3 tier architecture.

enter image description here

In this scenario it is common for the Presentation Layer to reside in a WebDMZ, the Application Layer to reside in an AppDMZ and the Data Layer to reside on the internal network.

If this isn't feasible for some reason or another, I recommend the database reside in a DatabaseDMZ.

The users on the internal network can still be granted access from the internal network to the server in the DatabaseDMZ. Do NOT allow the Database server to initiate communication to the internal network, only the other way around.

You want to avoid a situation where a server in a WebDMZ has direct access to the internal network.

Improve this answer
3
  • Having the application's data layer directly in the internal network requires the DMZ to be dual-homed to the public internet, and the internal network. This is not ideal, and should not be the preferred solution.
    – Xander
    Commented Dec 19, 2014 at 15:59
  • I think you may have misunderstood, or perhaps I am not following you. The DMZ is not dual-homed to the public internet and internal network. There are two separate DMZs - A WebDMZ and an AppDMZ. There is no access from the internet directly to the AppDMZ or internal network.
    – k1DBLITZ
    Commented Dec 19, 2014 at 16:11
  • Sorry, my comment wasn't clear at all. In the model you open with, the AppDMZ must initiate outbound requests to the internal network, where the data layer resides. This is not ideal. All application functions (including the data layer) should ideally be outside of the internal network, so the internal network need not be opened up to accept inbound requests.
    – Xander
    Commented Dec 19, 2014 at 16:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .