A regional retailer runs its whole business on one flat network. The online store's web server, the point-of-sale terminals, the HR file share, the printers and the guest Wi-Fi all sit in 10.20.0.0/16, and any device can reach any other. When an attacker exploits an outdated plugin on the web server, nothing stops that server from connecting straight to the payment database.
Security zones exist to prevent that. On the CompTIA Security+ SY0-801 exam they fall under objective 3.2, which expects you to make architecture decisions in a scenario: which zone a system belongs in, what traffic may cross between zones, and how to cut down the ways an attacker can reach anything at all. This lesson covers the common zones, the trust boundaries between them, the rules for traffic that crosses, and attack surface reduction. Where each security device goes is the next lesson.
A security zone groups systems that deserve the same level of trust
A security zone is a part of the network whose systems share a trust level and a security policy. Traffic that enters or leaves the zone has to pass an enforcement point, usually a firewall, that applies the rules for that zone. Traffic between systems inside the same zone faces fewer checks, which is exactly why zone membership matters.
Three questions decide which zone a system belongs in. Who needs to reach it: anyone on the internet, employees, or only one application? How sensitive is the data it holds or processes? And how likely is it to be attacked? A public web server that strangers connect to all day is far more likely to be compromised than the payroll database, so the two never share a zone, even when the same team runs both.
Zones are a policy idea, and the implementation varies. On premises, each zone is usually a VLAN with its own IP subnet, and a firewall routes between them. In the cloud, virtual networks, subnets and security groups do the same job. The most sensitive networks sometimes get physically separate switches. Logical and physical segmentation, including air gaps, are covered in the architecture models section.
The line between two zones is a trust boundary: the place where traffic moves from one trust level to another. A real boundary has three things: an enforcement point that can block traffic, written rules for what may cross, and logs of what crossed and what was refused. If you can draw a line between two zones on a diagram and nothing sits on that line, there is no boundary, only a label.
The screened subnet holds whatever the internet must reach
The screened subnet, still widely called the DMZ (demilitarized zone), sits between the internet and the internal network. It holds the systems that untrusted users must reach: public web servers, reverse proxies and load balancers, mail relays, public DNS servers, and file transfer servers for partners. You'll see both names used for the same zone.
The design assumes these systems will be attacked and that one of them may eventually be compromised. Everything about the zone follows from that assumption. The internet may reach only the specific services published there, such as TCP 443 on the web servers' public address. Systems in the screened subnet may start only narrow, named connections into the internal network, and ideally none. Data stores stay out of it: the web server reaches data through an application tier that sits behind another firewall.
There are two common ways to build one. A three-legged firewall uses one firewall with three interfaces: outside, screened subnet and inside. A dual-firewall design puts the screened subnet between an external firewall and an internal firewall, so an attacker has to get through two devices to reach internal systems. The dual design costs more and adds a second device to manage. Buying those two firewalls from different vendors is a diversity decision, covered later in this section.