What Is DMZ (Demilitarized Zone)?

A demilitarised zone is a network segment holding systems that must be reachable from the internet, separated from the internal network so that compromising one of them does not yield internal access. It is among the oldest network security patterns and it remains sound.

The principle is straightforward: anything exposed to hostile traffic should be assumed compromisable, so it is placed where compromise is contained.

What the pattern requires to work

The boundary has to be enforced in both directions. Permitting traffic from the internet into the zone is the obvious half; restricting what the zone can initiate toward the internal network is the half that determines whether containment holds.

A web server in a properly configured zone can accept requests and reach a specific database port on a specific internal host — and nothing else. Where that outbound restriction is missing, the zone is a naming convention rather than a boundary.

How it erodes

Gradually, through exceptions. A system in the zone needs to reach a file share, then a management server, then the domain controller for authentication. Each is granted individually and reasonably, and collectively they reconstruct the path the design existed to prevent.

Domain membership is the most common example. Joining a DMZ system to the internal domain for administrative convenience gives it — and anyone who compromises it — a relationship with the most sensitive internal infrastructure you operate.

Its relevance in cloud architectures

The pattern persists under different names. A public subnet holding load balancers with private subnets behind it is the same idea, as is placing an application gateway in front of services that are not directly reachable.

What has changed is that the boundary is now expressed as security groups and routing rules rather than physical topology, which makes it easier to implement and easier to undermine with a single over-broad rule.

Multiple zones rather than one

A single zone holding every externally facing system means a compromise of the least important one puts an attacker beside the most important. A public marketing site and a payment gateway do not belong on the same segment.

Separating by sensitivity and by function limits that lateral movement within the exposed estate itself. It costs more boundaries to manage and it means a compromised brochure site reaches nothing that matters.

The same reasoning applies to shared services placed there for convenience — a jump host or management server inside the exposed zone becomes the bridge an attacker was looking for.

Systems in the exposed zone also warrant a different patching posture. They face hostile traffic continuously, exploitation of internet-facing services frequently begins within days of disclosure, and a change window measured in weeks is not proportionate to that exposure.

A common mistake worth avoiding

Where to start

List the internal destinations your externally facing systems are permitted to reach. Anything beyond the specific ports and hosts they genuinely require is the erosion of the boundary you are relying on.

See network segmentation. GuardsArm runs security program reviews.