Network segmentation and DMZ: what goes where (Security+)
Segmentation splits a network into zones so traffic between them must pass a firewall or gateway that enforces policy. A DMZ is a zone for public-facing servers such as web and email servers, while systems the public never reaches, such as databases, stay on the internal network. Internal segmentation limits how far an attacker already inside can move.
The DMZ
NIST SP 800-41 Rev. 1 describes a DMZ as an interface on a routing firewall. Traffic between the DMZ and the protected network still passes through the firewall and can have policy applied. It is common to put public-facing servers, such as web and email servers, on the DMZ.
A database that only the web server queries is not public-facing. It stays on the internal network, and the firewall allows only the web server's queries to reach it. If the web server is compromised, the attacker still has to get through the firewall.
For industrial networks, NIST SP 800-82 Rev. 3 recommends a DMZ between the corporate and OT networks so no traffic passes directly between them. All communication goes through services in the DMZ, such as a server holding production data that corporate users read.
Physical and logical segmentation
Segmentation can be physical, with separate switches, or logical, with VLANs. A VLAN separates traffic by switch port. One 8-port switch can carry two VLANs, ports 1 to 4 and 5 to 8, and each port talks only to ports in its own VLAN. VLANs are used when physical separation costs too much. For high-criticality devices such as safety systems, NIST suggests physically separate switches.
East-west traffic and lateral movement
Perimeter firewalls, IDS and IPS mostly watch north-south traffic entering the network. NIST SP 800-215 says most traffic is now east-west, between servers inside the network, and largely invisible, so a threat already inside can move laterally undetected for days or months.
Segmenting the data center puts gateways between groups of servers that enforce access on east-west traffic. Microsegmentation makes the segments smaller so traffic in and out of each can be monitored and controlled, which restricts lateral movement by an attacker who has breached the perimeter or started inside.
Where the exam catches people
Believing the database belongs in the DMZ with the web server: only public-facing hosts go in the DMZ; the database stays internal behind the firewall.
Believing tighter perimeter rules stop lateral movement: perimeter controls watch north-south traffic; internal segmentation is needed for east-west traffic.
Believing an air gap is the answer when data must flow to the corporate side: a DMZ lets data cross through intermediate services with no direct traffic between the networks.
Believing a VLAN is physical segmentation: ports on one switch split by VLAN are logically separated, not physically.