Re: Re: Re: VM Host with guests on the Internal and DMZ networks

[ssk_outlaw () yahoo com]

on a different tangent, the biggest threat of such a setup is the threat from inside. the sysadmins.

the sysadmins at the flick of a switch (setting) are able to turn up/down ports on either networks, bridge the network 
segments thus bypassing commonly established security practices.

do you trust your sysadmins that much ?

while this is typically not possile with a phsyical layer seperating them where in typically a network/security team 
over sees the port allocation for new servers.

it's best if all dmz servers are stacked on a seperate VM Host and all the protected network servers are stacked on a 
different VM Host.

Hope this helps,

- S