Originally Posted by chaley
Still 
Because the same processor that controls the router security has direct access to the disc. Should some bad guy figure out how to penetrate the router, job done. If the storage is across the local LAN, then the bad guy must penetrate the router, and then penetrate the machine hosting the storage using only the access the LAN gives, adding a second layer of difficulty and another opportunity to detect the intrusion.
The is the same logic that people use when they set up a DMZ: a section of the LAN that is behind the entry router but in front of the company's assets. Customer-facing servers live there, getting their data through a security gateway between the DMZ and the company's computing infrastructure. Some people actually use 2 DMZs, putting the internal/external shared data in the second while putting the rest of the infrastructure after the second. |