We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict access via firewall rules? Has anyone here found any cons to just restricting access via firewall rules and O/S perms?
Note that this site is an ASP.NET MVC front-end with SQL Server back-end.
Also - this is an HR/Finance application, and the database back-end contains our most valuable data. From a security perspective, I'd rather give the world root access to intranet than allow access to the database server. As a result, my original plan was to skip using a DMZ and only opening up port 443 on the firewall to the web server ... this seemed no worse than putting the db server on the DMZ with the web server.