Separating IIS and SQL for security
Posted on 2014-01-07
I have a decent sized box that is running Windows Server 2008 R2, IIS (open to the Internet), and SQL 2008 R2. Currently SQL sole purpose is to feed data to the IIS interface. The box is behind a firewall with only port 80 (HTTP) open to the Internet. Other than performance gains, if secured properly, should I bother to separate SQL and IIS into two machines? What are the PROs and CONs of this?
Thanks in advance..