Yesterday I heard some people talking about not allowing users to RDP into servers they shouldn't and such which got me thinking about my companies network and the security of it.

Can someone point me in the right direction in regards to best practices for isolating and locking down machines? Do you create access control lists and apply those to the VLAN?

Our server network comprises of 4 physical VMware hosts with about 60 VMs. Some web servers, some database servers, terminal servers, email, ... . All servers are on one VLAN, user workstations/devices on another VLAN, guest traffic on another VLAN, security system on another VLAN. Then each VLAN then has its own IP scheme that relates to the VLAN such as x.x.10.1/24, x.x.20.1/24, .... .

Is it better to separate servers based on what data is on the server such as all SQL servers in one VLAN, web servers in another. Then apply an access control list to that VLAN that only allows certain ports in/out?


The Good Practice Guide 13 (gpg13) recommends a number of controls for baseline protective monitoring and information security measures. Also have a look at the link belows for some network security good practice guidelines.

These should provide a baseline to aim for. They will need to be tailored to your environment and compliance needs.You may want to look at hardening guides for servers and clients as well.

Have a look at these links. They both offer general primers and pointers in how to secure your network and the information flowing over it. Hope this suit your needs better.

Guidelines on general information Security;

10 security best practice guidelines for businesses

An article about network segmentation;

Improving Security via Proper Network Segmentation

Regulatory Guidance and Best Practices

Standards such as PCI-DSS provide guidance on creating clear separation of data within the network – in the case of PCI, cardholder data should be isolated from the rest of the network, which contains less sensitive information. An example would be to ensure that Point-of-Sale (PoS) systems and databases are completely separated from areas of the network where third parties have access. In this example a PCI Zone would be created with stringent constraints allowing connectivity for as few servers and applications as possible.

Routes to Achieve Proper Segmentation

Firewall and VLANs provide a route to partition the network into smaller zones, assuming you have defined and are enforcing a ruleset which controls the communication paths. A sound security policy entails segmenting the network into multiple zones with varying security requirements and enforcing a rigorous policy of what is allowed to move from zone to zone. Anything designated in the PCI zone, for example, should be isolated from the rest of the network as much as possible – without impacting the overall business.

Here are a few, but not an exhaustive list of tips to consider:

• Implement controls at multiple layers within the network architecture. The more layers you can add at each level (e.g. data, application, etc.), the harder it is for a cybercriminal to gain unauthorized access to sensitive information. Of course this has to be manageable from an operations standpoint and it can’t be to the point where business processes come to a grinding halt.

• Apply the rule of least privileged. For example, a third party vendor may need access to your network, but they most likely don’t need access to certain information. Access should only be provided to the user or system that is absolutely needed and nothing else.

• Segment information access based on your security requirements. Define your different zones based on where your sensitive information resides. For example, you want to make sure that sensitive information isn’t easily accessible by a third party that has no need for this access. Take a step back when looking at your network architecture and determine if there’s unnecessary access or too restrictive access in different places. You may be surprised by what you see.

• Leverage a whitelist or hybrid approach. Instead of trying to block all of the bad things out there, which puts you into a never-ending game of cat and mouse, define what you know to be acceptable communication paths and block everything else.

By Nimmy Reichenberg of securityweek.com

  • You need to include those guidelines instead of just linking to them.
    – schroeder
    Aug 21 '15 at 18:12
  • Sorry about that, I edited the reply. I didn't include the guidelines in the reply as it would have been a copy and paste job from someone else's website. Aug 23 '15 at 18:47
  • Yes, you need to do a copy/paste job or summarize the material or else you haven't really answered the question at all. The ZDNet link you provide is not on topic for the question.
    – schroeder
    Aug 23 '15 at 21:45
  • Okidoki, copy and pasted. ;) Aug 24 '15 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.