Internet Hosting and DMZ Standard

The objective of this standard is to define the configuration to be met by all servers owned or managed by Company that are located outside of the firewalls. The standards are designed to minimize the exposure to Company from damages that may result from malicious activities from both internal and external entities. Internet facing devices located outside the Company firewalls are considered part of the DMZ.

The standard outlines two goals for the deployment of systems in untrusted Company controlled environments. The first goal of this standard is to provide an approach to developing an environment designed to appropriately expose web applications to the Internet while protecting the internal network, application data and other applications from exposure. As the word ‘appropriately’ can be interpreted in many ways, this document’s purpose is to define the methodology and architecture of the DMZ design.

The second goal is that this infrastructure is designed for multiple tenant operations and lifecycle support.

a. Multiple Tenant Support: Each DMZ segment can house multiple applications, and, if desired, a VLAN can be assigned within each DMZ for the express purpose of housing a single application, or a class of applications.

b. Lifecycle Support: Each lifecycle (Production, Prod-Test, or QC) environment must be separated.