Editing DMZ (computing) (section)

{{short description|Subnetwork of a system exposed to external world}}
{{For|the physical area where military operations are prohibited|Demilitarized zone}}

In [[computer security]], a '''DMZ''' or '''demilitarized zone''' (sometimes referred to as a '''perimeter network''' or [[screened subnet]]) is a physical or logical [[subnetwork]] that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the [[Internet]]. The purpose of a DMZ is to add an additional layer of security to an organization's [[local area network]] (LAN): an external [[network node]] can access only what is exposed in the DMZ, while the rest of the organization's network is protected behind a [[Firewall (computing)|firewall]].<ref>{{Cite web|title=Control System Security DMZ|url=https://www.us-cert.gov/ics/Control_System_Security_DMZ-Definition.html|access-date=2020-06-09|website=Official website of The Cybersecurity and Infrastructure Security Agency (CISA) for the Dept. of Homeland Security, USA|archive-date=2020-06-09|archive-url=https://web.archive.org/web/20200609134629/https://www.us-cert.gov/ics/Control_System_Security_DMZ-Definition.html|url-status=dead}}</ref> The DMZ functions as a small, isolated network positioned between the Internet and the private network.<ref>{{Cite web|title=What is a DMZ and How does it Work?|url=https://searchsecurity.techtarget.com/definition/DMZ|access-date=2020-06-09|website=Techtarget SearchSecurity}}</ref>

This is not to be confused with a [[#DMZ_host|'''DMZ host''']], a feature present in some home routers that frequently differs greatly from an ordinary DMZ.

The name is from the term ''[[demilitarized zone]]'', an area between states in which military operations are not permitted.