The Good Practice Guide 13 (gpg13) recommends a number of controls for baseline protective monitoring and information security measures. Also have a look at the link belows for some network security good practice guidelines.
These should provide a baseline to aim for. They will need to be tailored to your environment and compliance needs.You may want to look at hardening guides for servers and clients as well.
Have a look at these links. They both offer general primers and pointers in how to secure your network and the information flowing over it. Hope this suit your needs better.
Guidelines on general information Security;
10 security best practice guidelines for businesses
An article about network segmentation;
Improving Security via Proper Network Segmentation
Regulatory Guidance and Best Practices
Standards such as PCI-DSS provide guidance on creating clear separation of data within the network – in the case of PCI, cardholder data should be isolated from the rest of the network, which contains less sensitive information. An example would be to ensure that Point-of-Sale (PoS) systems and databases are completely separated from areas of the network where third parties have access. In this example a PCI Zone would be created with stringent constraints allowing connectivity for as few servers and applications as possible.
Routes to Achieve Proper Segmentation
Firewall and VLANs provide a route to partition the network into smaller zones, assuming you have defined and are enforcing a ruleset which controls the communication paths. A sound security policy entails segmenting the network into multiple zones with varying security requirements and enforcing a rigorous policy of what is allowed to move from zone to zone. Anything designated in the PCI zone, for example, should be isolated from the rest of the network as much as possible – without impacting the overall business.
Here are a few, but not an exhaustive list of tips to consider:
• Implement controls at multiple layers within the network architecture. The more layers you can add at each level (e.g. data, application, etc.), the harder it is for a cybercriminal to gain unauthorized access to sensitive information. Of course this has to be manageable from an operations standpoint and it can’t be to the point where business processes come to a grinding halt.
• Apply the rule of least privileged. For example, a third party vendor may need access to your network, but they most likely don’t need access to certain information. Access should only be provided to the user or system that is absolutely needed and nothing else.
• Segment information access based on your security requirements. Define your different zones based on where your sensitive information resides. For example, you want to make sure that sensitive information isn’t easily accessible by a third party that has no need for this access. Take a step back when looking at your network architecture and determine if there’s unnecessary access or too restrictive access in different places. You may be surprised by what you see.
• Leverage a whitelist or hybrid approach. Instead of trying to block all of the bad things out there, which puts you into a never-ending game of cat and mouse, define what you know to be acceptable communication paths and block everything else.
By Nimmy Reichenberg of securityweek.com