Why does operating a DMZ with host-based firewalls on every resource become an organisational problem on premises?

On premises, IT operations are usually split along technologies, and none of the teams fits the job: the network team, which looks after firewalls, rejects host-based firewalls as non-network components; the server administrators lack the background to write firewall rules; and the database administrators understand little about networking.

* The filters sit on the servers, but the firewall knowledge sits with a team that doesn't own servers. *

The technical solution from the previous card moves the firewall function from the network onto the WAF, the web server and the database. That cuts straight across the usual organisation chart: the people who own the box (web admin, server admin, DB admin) are not the people who know how to write and review rules, and the people who know the rules don't consider the box their responsibility. Unless someone is given clear ownership of the host filters, they end up unmaintained or too permissive, which quietly undoes the segmentation.

Tip: an architecture is only as good as the team that can run it. When a design moves a control to a new place, ask who will operate it there.

Go deeper:

• Conway's law — Wikipedia — why systems end up mirroring the organisation that builds and runs them.
• Microsegmentation (network security) — Wikipedia — the operational trade-offs of host-based segmentation.