A Web server takes a request and throws it over the firewall to an enterprise object server, which in turn encapsulates the logic and access to your back-end systems. But reality is not so simple. First, there is no standard application server. Furthermore, once you open that Pandora's box of application data flows you'll find that the data is scattered all over your organization. The alternative is to argue about, fund and secure each and every application independently.
Security management is a balancing act between risk and reward, access and return.
The better the balance, the greater the benefit for the entire organization. However, e-commerce is probably the first application that really puts pressure on your internal security. In terms of internal financing, let's just say it's unfair if the first passenger pays for the whole bus while everyone else rides for free. If you're serious about e-commerce, you must lay the groundwork for examining security from behind the firewall. By looking at security this way, you elevate all the network segments to a series of DMZs.