content_image/997246.jpg
## External exposure of services 

Around this time, we started to see enterprises exploring exposure of interfaces beyond the boundary of the organization. There are much more challenging security implications in this situation, so the idea of a secure gateway in the DMZ was introduced, as shown in Figure 3-2 on page 44. 

<img src='content_image/997246.jpg'>

This gateway had only one job: to securely expose the interfaces on the internet, handling whatever security model was required, and protecting against other forms of attacks, such as denial of service, and even payload-based attacks, such as XML threats. It then passed the request on the enterprise’s network to an integration engine that performed the integration to the back-end system’s protocols, performed data mapping, and did any composition of invocations that were required to form the response. This situation encouraged a separation of duties between exposure (on the gateway) and integration (in the integration run time) so that each component could focus on what it does best. 

