Most web applications need data from internal systems. How should a DMZ application be connected to the backend?

Through content- and interaction-controlled paths: gateways, data-exchange platforms or data-exchange services with a suitable control function, so that the backend is reached through a checkpoint rather than directly.

* The DMZ tiers and the internal zones meet only at one controlled data-transfer point. *

Web applications are rarely isolated web pages; an online shop needs prices and stock levels from the company's merchandise-management system (German Warenwirtschaftssystem, WWS), and orders have to flow back. A typical layout has four DMZ zones: exposed (WAF, the only public IP), dmz-webgui (web server), dmz-applogic (application logic and an app service) and dmz-data (database and a data service), each separated by firewalls. On the internal side sit internal-server (the merchandise-management system) and internal-data (its database). The only link between the two worlds is a data-transfer component between the application-logic zone and the internal server zone, with a firewall in front of it.

That component is where the backend's perimeter is enforced: it decides which data may cross, in which direction and in which format, just as the WAF does for the internet side.

Go deeper:

• Cross-domain solution — Wikipedia — controlled data transfer between security domains, the strict form of this idea.
• DMZ (computing) — Wikipedia — the zone between internet and internal network.