diff --git a/README.md b/README.md
index b96b152..633d8cb 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,9 @@ Feel free to explore the topics and use this as a reference for software enginee
 ### Design Patterns
 - [Circuit Breaker Pattern](./circuit-breaker-pattern.md) - Learn about protecting services from cascading failures in distributed systems
 
+### Network Security & Architecture
+- [Demilitarized Zone (DMZ)](./dmz-demilitarized-zone.md) - Understanding DMZ concepts in computer science, network security, and modern cloud architectures
+
 ### Machine Learning & Data Science
 - [Croissant Metadata](./croissant-metadata.md) - Understanding the standardized metadata format for ML datasets, its components, advantages, and why it was created.
 
diff --git a/dmz-demilitarized-zone.md b/dmz-demilitarized-zone.md
new file mode 100644
index 0000000..0186673
--- /dev/null
+++ b/dmz-demilitarized-zone.md
@@ -0,0 +1,512 @@
+# Demilitarized Zone (DMZ) in Computer Science
+
+## Definition
+
+A **Demilitarized Zone (DMZ)** in computer science is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually the internet. The DMZ acts as a buffer zone between the trusted internal network and the untrusted external network, providing an additional layer of security.
+
+## Core Concept
+
+The DMZ concept is borrowed from military terminology, where a demilitarized zone is a buffer area between two opposing forces. In networking and cybersecurity:
+
+- **Isolation**: Separates external-facing services from internal systems
+- **Controlled Access**: Provides managed entry points to organizational resources
+- **Security Buffer**: Creates a protective barrier against external threats
+- **Risk Mitigation**: Limits the impact of potential security breaches
+
+## Why DMZ is Important
+
+### 1. **Security Enhancement**
+- Protects internal networks from direct exposure to the internet
+- Isolates public-facing services from sensitive internal systems
+- Provides layered security architecture
+
+### 2. **Risk Containment**
+- Limits the scope of potential security breaches
+- Prevents lateral movement from compromised external services
+- Reduces attack surface for internal systems
+
+### 3. **Compliance Requirements**
+- Helps meet regulatory standards (PCI DSS, HIPAA, SOX)
+- Provides audit trails and access controls
+- Ensures proper data segregation
+
+### 4. **Performance Optimization**
+- Reduces load on internal firewalls
+- Enables efficient traffic routing
+- Allows for specialized security appliances
+
+## DMZ Architecture Types
+
+### 1. Traditional Three-Tier DMZ
+
+```
+Internet → External Firewall → DMZ → Internal Firewall → Internal Network
+```
+
+**Components:**
+- **External Firewall**: Filters traffic from the internet
+- **DMZ Segment**: Contains public-facing servers
+- **Internal Firewall**: Protects internal network
+- **Internal Network**: Houses sensitive organizational data
+
+### 2. Dual-Homed DMZ
+
+```
+Internet → Firewall (Dual-Homed) → Internal Network
+               ↓
+              DMZ
+```
+
+**Characteristics:**
+- Single firewall with multiple network interfaces
+- DMZ connected to dedicated firewall interface
+- Cost-effective for smaller organizations
+- Simpler management but potentially less secure
+
+### 3. Screened Subnet DMZ
+
+```
+Internet → Router → External Firewall → DMZ → Internal Firewall → Internal Network
+```
+
+**Features:**
+- Additional router for traffic routing
+- Enhanced security through multiple checkpoints
+- Better traffic analysis capabilities
+- Suitable for large enterprise environments
+
+## Common DMZ Services
+
+### 1. **Web Servers**
+```bash
+# Example: Nginx configuration for DMZ web server
+server {
+    listen 80;
+    listen 443 ssl;
+    server_name example.com;
+    
+    # Security headers
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    
+    # Reverse proxy to internal application servers
+    location / {
+        proxy_pass http://internal-app-server:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+### 2. **Mail Servers**
+- SMTP servers for incoming/outgoing email
+- Mail relay servers
+- Anti-spam and anti-virus gateways
+
+### 3. **DNS Servers**
+- External DNS for public domain resolution
+- DNS forwarding to internal DNS servers
+- DNS security services (DNS filtering)
+
+### 4. **VPN Gateways**
+- Remote access VPN endpoints
+- Site-to-site VPN terminators
+- SSL/TLS VPN portals
+
+### 5. **Application Proxies**
+- Reverse proxies for web applications
+- API gateways
+- Load balancers
+
+## DMZ Security Best Practices
+
+### 1. **Firewall Configuration**
+
+#### External Firewall Rules
+```bash
+# Example iptables rules for external firewall
+# Allow HTTP/HTTPS to DMZ web servers
+iptables -A FORWARD -p tcp --dport 80 -d 192.168.100.0/24 -j ACCEPT
+iptables -A FORWARD -p tcp --dport 443 -d 192.168.100.0/24 -j ACCEPT
+
+# Allow SSH for management (restricted source)
+iptables -A FORWARD -p tcp --dport 22 -s 203.0.113.0/24 -d 192.168.100.0/24 -j ACCEPT
+
+# Default deny all
+iptables -P FORWARD DROP
+```
+
+#### Internal Firewall Rules
+```bash
+# Allow specific traffic from DMZ to internal network
+# Database access for web applications
+iptables -A FORWARD -p tcp --dport 3306 -s 192.168.100.10 -d 10.0.0.50 -j ACCEPT
+
+# LDAP authentication
+iptables -A FORWARD -p tcp --dport 389 -s 192.168.100.0/24 -d 10.0.0.100 -j ACCEPT
+
+# Default deny DMZ to internal
+iptables -A FORWARD -s 192.168.100.0/24 -d 10.0.0.0/8 -j DROP
+```
+
+### 2. **Network Segmentation**
+- Use VLANs to isolate DMZ traffic
+- Implement proper subnet addressing
+- Configure appropriate routing policies
+
+### 3. **Access Control**
+- Implement least privilege principle
+- Use strong authentication mechanisms
+- Regular access reviews and audits
+
+### 4. **Monitoring and Logging**
+- Deploy intrusion detection systems (IDS)
+- Implement comprehensive logging
+- Real-time security monitoring
+
+## Modern DMZ Applications
+
+### 1. **Cloud DMZ**
+
+#### AWS DMZ Example
+```yaml
+# CloudFormation template for AWS DMZ
+Resources:
+  PublicSubnet:
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      CidrBlock: 10.0.1.0/24
+      MapPublicIpOnLaunch: true
+      
+  PrivateSubnet:
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      CidrBlock: 10.0.2.0/24
+      
+  NATGateway:
+    Type: AWS::EC2::NatGateway
+    Properties:
+      AllocationId: !GetAtt EIPForNAT.AllocationId
+      SubnetId: !Ref PublicSubnet
+      
+  SecurityGroupDMZ:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: DMZ Security Group
+      VpcId: !Ref VPC
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 80
+          ToPort: 80
+          CidrIp: 0.0.0.0/0
+        - IpProtocol: tcp
+          FromPort: 443
+          ToPort: 443
+          CidrIp: 0.0.0.0/0
+```
+
+### 2. **Container DMZ**
+
+#### Docker DMZ Setup
+```bash
+# Create DMZ network
+docker network create --driver bridge dmz-network
+
+# Run reverse proxy in DMZ
+docker run -d \
+  --name nginx-proxy \
+  --network dmz-network \
+  -p 80:80 -p 443:443 \
+  -v /etc/nginx/conf.d \
+  nginx:alpine
+
+# Run application containers in isolated network
+docker network create --driver bridge internal-network
+
+docker run -d \
+  --name app-server \
+  --network internal-network \
+  myapp:latest
+```
+
+#### Kubernetes DMZ with Network Policies
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: dmz-policy
+  namespace: dmz
+spec:
+  podSelector:
+    matchLabels:
+      tier: dmz
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector: {}
+    ports:
+    - protocol: TCP
+      port: 80
+    - protocol: TCP
+      port: 443
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          name: backend
+    ports:
+    - protocol: TCP
+      port: 8080
+```
+
+### 3. **Microservices DMZ**
+
+#### API Gateway as DMZ
+```javascript
+// Express.js API Gateway example
+const express = require('express');
+const httpProxy = require('http-proxy-middleware');
+const rateLimit = require('express-rate-limit');
+
+const app = express();
+
+// Rate limiting
+const limiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100 // limit each IP to 100 requests per windowMs
+});
+
+app.use(limiter);
+
+// Authentication middleware
+app.use('/api', (req, res, next) => {
+  const token = req.headers.authorization;
+  if (!isValidToken(token)) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+  next();
+});
+
+// Proxy to internal services
+app.use('/api/users', httpProxy({
+  target: 'http://user-service:3001',
+  changeOrigin: true,
+  pathRewrite: {
+    '^/api/users': '/'
+  }
+}));
+
+app.use('/api/orders', httpProxy({
+  target: 'http://order-service:3002',
+  changeOrigin: true,
+  pathRewrite: {
+    '^/api/orders': '/'
+  }
+}));
+
+app.listen(3000);
+```
+
+## DMZ Implementation Strategies
+
+### 1. **Planning Phase**
+- **Risk Assessment**: Identify threats and vulnerabilities
+- **Service Classification**: Categorize services by security requirements
+- **Network Design**: Plan IP addressing and routing
+- **Security Policies**: Define access control rules
+
+### 2. **Implementation Phase**
+- **Hardware Setup**: Deploy firewalls and network equipment
+- **Software Configuration**: Configure security rules and policies
+- **Service Deployment**: Install and configure DMZ services
+- **Testing**: Verify security controls and functionality
+
+### 3. **Maintenance Phase**
+- **Regular Updates**: Apply security patches and updates
+- **Monitoring**: Continuous security monitoring and alerting
+- **Auditing**: Regular security assessments and compliance checks
+- **Incident Response**: Maintain incident response procedures
+
+## Common DMZ Challenges
+
+### 1. **Complexity Management**
+- Multiple firewall rules and policies
+- Complex network routing configurations
+- Service interdependencies
+
+**Solutions:**
+- Documentation and configuration management
+- Automation tools and scripts
+- Regular architecture reviews
+
+### 2. **Performance Impact**
+- Additional network hops and latency
+- Firewall processing overhead
+- Bandwidth limitations
+
+**Solutions:**
+- High-performance firewall appliances
+- Load balancing and redundancy
+- Traffic optimization techniques
+
+### 3. **Cost Considerations**
+- Additional hardware and software licenses
+- Increased management overhead
+- Specialized security expertise requirements
+
+**Solutions:**
+- Cloud-based DMZ solutions
+- Virtual appliances and software-defined networking
+- Managed security services
+
+## DMZ vs. Other Security Concepts
+
+### DMZ vs. Firewall
+| Aspect | DMZ | Firewall |
+|--------|-----|----------|
+| **Purpose** | Network segment isolation | Traffic filtering and control |
+| **Scope** | Architectural concept | Security device/software |
+| **Implementation** | Requires multiple components | Single point solution |
+| **Complexity** | Higher complexity | Moderate complexity |
+
+### DMZ vs. VPN
+| Aspect | DMZ | VPN |
+|--------|-----|------|
+| **Access Type** | Public service hosting | Secure remote access |
+| **User Base** | External users/public | Authorized users only |
+| **Security Model** | Perimeter defense | Encrypted tunneling |
+| **Use Case** | Public-facing services | Remote connectivity |
+
+### DMZ vs. Zero Trust
+| Aspect | DMZ | Zero Trust |
+|--------|-----|-----------|
+| **Trust Model** | Perimeter-based trust | Never trust, always verify |
+| **Architecture** | Network segmentation | Identity-centric security |
+| **Assumption** | Internal network is trusted | No implicit trust anywhere |
+| **Implementation** | Traditional networking | Modern security frameworks |
+
+## Monitoring and Alerting
+
+### 1. **Security Metrics**
+```bash
+# Example: DMZ monitoring script
+#!/bin/bash
+
+# Monitor DMZ traffic patterns
+netstat -i | grep dmz-interface
+
+# Check firewall logs for anomalies
+tail -f /var/log/firewall.log | grep -E "(DENY|DROP|REJECT)"
+
+# Monitor service availability
+curl -I http://dmz-webserver/health
+
+# Check for unauthorized access attempts
+grep "Failed password" /var/log/auth.log | grep dmz-subnet
+```
+
+### 2. **Automated Alerting**
+```python
+# Example: Python monitoring script
+import subprocess
+import smtplib
+from email.mime.text import MIMEText
+
+def check_dmz_services():
+    services = ['web-server', 'mail-server', 'dns-server']
+    failed_services = []
+    
+    for service in services:
+        try:
+            result = subprocess.run(['systemctl', 'is-active', service], 
+                                  capture_output=True, text=True)
+            if result.stdout.strip() != 'active':
+                failed_services.append(service)
+        except Exception as e:
+            failed_services.append(service)
+    
+    if failed_services:
+        send_alert(f"DMZ Services Down: {', '.join(failed_services)}")
+
+def send_alert(message):
+    msg = MIMEText(message)
+    msg['Subject'] = 'DMZ Alert'
+    msg['From'] = 'dmz-monitor@company.com'
+    msg['To'] = 'security-team@company.com'
+    
+    # Send email alert
+    with smtplib.SMTP('localhost') as server:
+        server.send_message(msg)
+```
+
+## Industry Standards and Compliance
+
+### 1. **PCI DSS Requirements**
+- DMZ implementation for card data environment
+- Network segmentation requirements
+- Regular vulnerability scans
+
+### 2. **NIST Cybersecurity Framework**
+- Identify: Asset inventory and risk assessment
+- Protect: Access controls and data security
+- Detect: Continuous monitoring
+- Respond: Incident response procedures
+- Recover: Recovery and improvement plans
+
+### 3. **ISO 27001**
+- Information security management system
+- Risk assessment and treatment
+- Security controls implementation
+
+## Future Trends
+
+### 1. **Software-Defined DMZ**
+- Virtual network functions (VNF)
+- Software-defined perimeter (SDP)
+- Dynamic security policies
+
+### 2. **AI-Enhanced Security**
+- Machine learning for threat detection
+- Automated incident response
+- Behavioral analysis and anomaly detection
+
+### 3. **Cloud-Native DMZ**
+- Serverless security functions
+- Container-based security services
+- Multi-cloud DMZ architectures
+
+## Conclusion
+
+The Demilitarized Zone (DMZ) remains a fundamental concept in network security and system architecture. While traditional DMZ implementations focused on physical network separation, modern applications extend the concept to cloud environments, containers, and microservices architectures.
+
+Key takeaways:
+- **Essential Security Layer**: DMZ provides crucial isolation between external and internal networks
+- **Evolving Implementation**: Modern DMZ concepts adapt to cloud and containerized environments
+- **Layered Defense**: DMZ is part of a comprehensive security strategy, not a standalone solution
+- **Continuous Monitoring**: Effective DMZ requires ongoing monitoring and maintenance
+- **Compliance Enabler**: DMZ helps organizations meet various regulatory requirements
+
+As network architectures continue to evolve with cloud computing, microservices, and zero-trust models, the DMZ concept adapts while maintaining its core purpose: providing a secure buffer zone that protects critical internal resources while enabling necessary external access.
+
+## Further Reading
+
+- **NIST Special Publication 800-41**: Guidelines for Firewalls and Firewall Policy
+- **SANS Institute**: DMZ Architecture and Design Best Practices
+- **RFC 2647**: Benchmarking Terminology for Firewall Performance
+- **Cloud Security Alliance**: Cloud Controls Matrix
+- **OWASP**: Application Security in DMZ Environments
+
+**Books:**
+- "Network Security Architectures" by Sean Convery
+- "Building Secure and Reliable Network Architectures" by Sean Convery
+- "Firewalls and Internet Security" by William Cheswick and Steven Bellovin
+
+**Online Resources:**
+- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
+- [SANS Reading Room - DMZ](https://www.sans.org/reading-room/whitepapers/firewalls/dmz-design-1586)
+- [AWS VPC Security Best Practices](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html)
\ No newline at end of file