... And you, like a wise IT admin, run all your servers elsewhere on the internet, not inside your corp network, for a whole raft of reasons I won't go into here
As a not-so-wise IT admin, what reasons are these?
Having all your corporate servers in the same network is a bad idea because if one of the servers is compromised, the attacker can easily spread out to the others. Servers are often configured to be secure on the front end, but when it comes to servers communicating with each other, there are various ways to find vulnerabilities. Also the sensitivity of data is often not the same. While a web server is important for the availability, a database server often contains valuable customer data. Separating these is a good idea in any case.
Specialized hosting providers for specific servers are mostly able to keep their servers more secure as well.
Thanks to the internet, there is no reason not to separate servers, unless your application is so time dependent that for example database servers need to be accessed directly.
There is nothing wrong with running servers inside the corporate network - except that the corporate network should not be one wide, flat network. You should consider segregating assets and users into different "zones" and then write rules that allow the right (and expected) access between those zones. in your model, include "internet zone" and also any direct links to third parties you company may have (e.g. vpn to suppliers)
I would always use firewalls rather than simply splitting the network into VLANs. Firewalls offer better functionality to build rules (or groups of rules) so you can whitelist traffic that you expect to flow between zones.
You can place security controls on intra-zone borders, such as:
Organising the zones will be different for every organisation, but commoin examples are:
There are some risks. Take care not to over do the number of zones and make it too complex. Otherwise the burden of maintaining rules will become a big cost. Consider investing in a firewall product that has a good rules management or even a separate rules management application (e.g. Tuffin SecureTrack + there are others too).
Also be aware that some firewall suppliers have proprietary ways of adding ACLs to rules; these can have a heavy hit on performance of the firewall and you may need larger kit than expected.
Servers usually need to be accessed from the Internet, so your network design must allow connections from the Internet to the network where your servers are. Now if you put the servers in the internal network, that means you have to expose the internal network to the Internet by design.
And there is no reason to put the servers in the company network anyway. Even if the servers are used from the workstations in the company network, they (usually) don't need to establish connections to the workstations.
Without rehashing what others have already brought out, here are a couple more reasons from a network admin perspective:
Keeping your servers on a separate security zone, subnet and VLAN provides network segmentation. This will reduce unnecessary broadcast traffic to your servers and provide more bandwidth between server-to-server traffic. Network segmentation is an important part of network security and design that I would encourage you to learn more about.
And along similar lines: with a separate security zone, forcing your clients to pass through a hardware firewall to communicate with your servers allows for much more granular control over what traffic is permitted to and from your servers. This can serve for a variety of security purposes and can also help prevent viruses such as worms from even having the ability to exploit a port on your server that is otherwise open and susceptible to attacks. Clients are naturally going to be less secure because your users have the ability, to varying degrees, of doing insecure things on and with them. The servers however, you have full control over.
You could further segment servers into two separate zones. One zone would be for your internal servers that don't necessarily provide any sort of hosting and don't need to be accessed by the outside world. The other zone would be a type of server-DMZ where servers that are accessed by the outside world for whatever their hosting and would have a completely different set of security parameters.