DMZ (Demilitarized Zone)

DMZ (demilitarized zone) is a separate network segment that sits between an organization's internal network and the public internet, hosting public-facing services like web and email servers. It acts as a buffer zone, isolating exposed systems from sensitive internal resources.

If an attacker compromises a server in the DMZ, strict firewall↗ rules are designed to prevent them from pivoting directly into the internal network. This segmentation limits the blast radius of a breach involving any internet-facing system.