D-Link DFL-1600 User Manual page 36

16 Chapter 3. Firewall Principles
Rather, the problem is that insecure machines can execute commands on
"protected" machines.
Another form of protection worth considering is to set up a separate data
source that contains limited information to which the web server has access.
It should only contain information deemed sufficiently insensitive to be
accessed from the web server. This process requires an automatic export of
data from the internal data source to the external data source, to be
executed when information needs to be updated, or at fixed times of the
day. An insurmountable problem may arise when the web server needs to
update the data source. The best way of tackling such a problem is to move
the affected data source to a separate network segment, thereby decreasing
the potential damage in the case of intrusion.
D-Link Firewalls User's Guide