Quantitative Comparative Analysis of Traditional, Virtualized, and Cloud-Based DMZ Architectures for Securing Local Area Networks
محتوى المقال
الملخص
Demilitarized Zone (DMZ) architectures are widely deployed to protect Internet-facing services in local area networks. However, their quantitative security effectiveness across physical, virtualized, and cloud-based environments remains insufficiently documented. This study presents a structured and reproducible quantitative comparison of these DMZ architectures using controlled and simulated cyberattack scenarios. Security performance was evaluated using measurable indicators including intrusion probability, recovery time, and service availability. The experimental analysis demonstrates that DMZ deployment significantly reduces successful intrusion probability and improves network resilience compared to non-segmented architectures. Physical DMZ architectures provide the highest isolation level, while virtualized and cloud-based environments DMZs offer improved scalability and faster recovery capabilities. The results contribute a quantitative evaluation framework to support secure network architecture design and provide insights for integrating DMZ with modern security paradigms such as Zero Trust.
الكلمات المفتاحية
Cybersecurity، demilitarized zone (DMZ)، intrusion probability، network security، network segmentation، risk modeling، service availability، zero trust
التنزيلات
المراجع
B. Schneier, Network Security: Protecting Data in the Age of Cyber Threats. Hoboken, NJ, USA: Wiley, 2011.
Fortinet, “What is a DMZ and why would you use one?” Fortinet Documentation, 2023. [Online]. Available: https://www.fortinet.com/resources/cyberglossary/what-is-dmz. [Accessed: May 20, 2026].
M. Gallo and W. Hancock, Networking and Security Fundamentals: DMZ and Firewall Design. Boston, MA, USA: Pearson Education, 2016.
P. Morris, “The evolution of DMZ in virtualized and cloud environments,” International Journal of Network Security, vol. 14, no. 3, pp. 178–192, 2022.
Y. Kobayashi and H. Lee, The Evolution of Security Zones: From Geopolitical to Cybersecurity Applications. Cham, Switzerland: Springer, 2014.
K. Salhi, “Segmentation and segregation mechanisms and models to secure industrial control systems,” Ph.D. dissertation, Dept. Computer Science, University of Lorraine, Nancy, France, 2019.
B. Scanlon and L. Rocco, “Securing network architectures: A case study of DMZ in critical infrastructure,” J. Cybersecurity Res., vol. 6, no. 2, pp. 88–97, 2018.
A. Essaidi, V. Boistuaud, and N. Diop, “Conception of a demilitarized zone (DMZ),” Tech. Rep., Université de Marne-la-Vallée, Marne-la-Vallée, France, 2019.
C. Chen and Z. Zhang, Optimizing Network Security with DMZ: A Case Study in Enterprise Environments. Amsterdam, Netherlands: Elsevier, 2020.
B. Liskov and R. Smith, “The role of DMZ in cybersecurity risk mitigation,” in Proc. Int. Conf. Network Security Management, Paris, France, 2020, pp. 45–62.
J. Norris, The Concept of DMZ in Network Security: From Military Strategy to Cyber Defense. Cham, Switzerland: Springer, 2017.
A. T. Tunggal, What Is Zero Trust? A Model for More Effective Security, 2021.
Y. Shen and X. Wang, “Integrating artificial intelligence into DMZ-based security architectures,” Cybersecurity and AI Applications Journal, vol. 5, no. 1, pp. 112–127, 2020.
Cisco Systems, “Best practices for implementing DMZ in LAN security,” Cisco White Paper, 2023. [Online]. Available: https://www.cisco.com/. [Accessed: May 20, 2026].
M. Baker, Modern Approaches to LAN Security: DMZ and Beyond. Cham, Switzerland: Springer, 2023.
Tufin, “Understanding DMZ Networks and Improving Enterprise Security,” 2025. [Online]. Available: https://www.tufin.com/. [Accessed: May 20, 2026].
University of Quebec, “Cloud Security: DMZ and Segmentation for Securing Web Services in the Cloud,” Tech. Rep., Quebec, QC, Canada, 2020.
M. Alabbad, N. Mhaskar, and R. Khedri, “Hardening of network segmentation using automated referential penetration testing,” J. Netw. Comput. Appl., vol. 235, Art. no. 103861, 2024.
A. Palma and S. Bonomi, “Vulnerable network generator for experimental evaluation of attack graph scalability,” Comput. Secur., vol. 145, Art. no. 103952, 2025.
S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” Nat. Inst. Stand. Technol., Gaithersburg, MD, USA, NIST SP 800-207, Aug. 2020.
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.