I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server.
We provide solutions to clients within an intranet using windows authentication. Our clients normal have 100s of users and the information is sensitive but not critically important I.e. Personal or business info but not credit card numbers. We have a separate web (asp.net) and app server I am just wondering if in security terms if this really adds much since there is no dmz and both boxes exist on the same domain in order to use windows authentication and impersonation.
I am tempted to merge the app and web server for reasons of simplicity, removing delegation issues, cost and scalability.
Really my question is in the scenario above does having a separate web and app server really improve security by a large amount?