Does a DMZ make sense?

[Patrick M. Hausen]

That was not primarily directed at you. We are basically on the same side.

Sometimes even an application redesign is a perfectly applicable solution. For example in a large web portal we implemented user authentication and role based access. So far so good. The user data itself came from SAP R3 and was considered highly critical.

So instead of copying the user records into the web portal database where any remote code execution (which happens from time to time in web applications implemented in PHP/MySQL/etc.) would have easily lead to a "select * from users;" by the attacker we implemented an authentication service run on a different machine located in a different zone exposing only an API of our own design. That API did not have any "enumeration" function but only allowed for authentication and requesting additional data of a single user which the client (the web portal in this scenario) needed to provide in advance.

It remains difficult and requires skills and experience. That's why I am not dreading to be replaced by AI.

Kind regards,
Patrick

[meyergru]

It remains difficult and requires skills and experience. That's why I am not dreading to be replaced by AI.

Wise words, Patrick - and you are right.