Which technical building blocks make up the on-premises security architecture for publisher Z's new web platform?

Separate the web platform into a DMZ with firewalls and a WAF for control; split the DMZ into an app zone with an up-to-date web server and a data zone with the MySQL database on private IPs; give the WAF a subscription rule set, operated with an IT service provider; protect the backend connection with content control; and update the technology stack.

* Only the WAF faces the internet; app and data zones sit behind it on private addresses, and the backend is reached through content control. *

1. DMZ with firewall and WAF. The platform moves out of the general data centre network into its own DMZ. The only public IP is in front of the WAF; the web server behind it has a private IP.
2. App zone and data zone. The current web server and its code sit in zone app; the MySQL database moves into a separate zone data with a private IP, behind its own firewall, the segmented n-tier DMZ pattern.
3. WAF with a subscription rule set (German Abo-Regelwerk), operated together with an IT service provider. Z has no internal know-how, so it buys rules that are kept current against new attacks, and help to run them.
4. Backend connection with content control. A firewall and content control sit between the DMZ and the backend systems, so the platform can't become a short circuit into the publisher's business systems or printing works.
5. Update the technology stack, either to a current LAMP stack or to a different current stack. Which one is usually not a cyber security question; what matters is that it is current and maintained.

Go deeper:

• OWASP CRS (Core Rule Set) project — the maintained, open rule set that many WAFs use.
• DMZ (computing) — Wikipedia — the zone the platform moves into.