Learn in the textbookAdvanced Threat Protection and Network Architecture / Communication Security
DefinitionA DMZ is an intermediate zone separated by firewalls from both the outside (the internet) and the internal LAN, and it is where servers open to the public are placed.
ExplanationOutside users can reach the servers in the DMZ, but traffic from the DMZ to the internal LAN is stopped by a firewall. A public server placed directly on the internal LAN would, if taken over, become a doorway straight into the company. Keeping it in the DMZ means that even if the public server is compromised, attackers find it hard to use it as a stepping stone (踏み台) into the internal LAN.
AnalogyIt is like a company's reception lobby. Visitors can enter the lobby, but a locked door stands between it and the offices behind, so trouble in the lobby cannot reach the offices.
Memory hookShort for DeMilitarized Zone, a military term for a buffer area placed between two opposing sides.