An auditor reviewing our system was suggesting that our data should be stored on a separate physical server from the web server. We're running SQL 2008 on a Windows 2003 machine with IIS as the web server running ASP.NET 3.5 applications.

I can't think of any significant reason that there would more security by having SQL on a separate box. The website still accesses SQL so there's no reduction of SQL injection possibility (we protect against that of course), and we would use RPD to admin the SQL machine just like the web server.

Can anyone with more security knowledge give some insight as to why it would be better, or if in fact it's not any more secure?