DMZ (demilitarised zone)

A DMZ, short for demilitarised zone, is a network segment that sits between an organisation’s internal network and an external one, typically the internet.

Its purpose is to add a layer of separation between internal resources and the services that are meant to be reachable from outside.

That separation protects the internal systems from external threats, and limits the damage when a server that is exposed on purpose gets compromised.

What a DMZ does

It acts as a protective barrier that controls and filters traffic in both directions between the internal and the external network.

The servers and services placed in the DMZ are configured so that only the access they actually need is allowed from outside, which keeps the attack surface small.

A typical configuration puts the public facing servers there: web servers, mail servers, remote access gateways. They live in the DMZ instead of the internal network precisely so that the organisation’s internal systems and sensitive data are not on the same segment.

A worked example

The commonest example is a web server.

The web server goes in the DMZ so that people on the internet can reach the company website.

The database server holding the confidential information stays on the internal network, behind the firewall that separates it from the DMZ.

That way, even if the web server is compromised, the sensitive data is not one hop away.

DMZ, network segmentation and microsegmentation

All three separate things. The difference is where they draw the line and which movement they actually stop.

The DMZ separates what is published from what is not. It is a boundary between the internet and the internal network, designed for traffic arriving from outside, and that is why the web server and the mail server live there and the database does not.

Network segmentation is the general practice: dividing the network into zones so that compromising one does not hand over the next. The DMZ is its oldest and best known case, not a separate concept.

Microsegmentation goes one level down: policy attaches to the workload rather than the subnet, so two servers in the same zone can be unable to see each other.

Why the distinction matters: a well built DMZ says nothing about what happens inside. On an internal test the question is not whether the web server was isolated from the internet, it is how far you get from the first machine you compromise, and that is decided by the other two. A network that is segmented on the diagram and flat in practice is what separates a contained incident from one that takes the whole domain.