To answer your first question, you may find helpful a white paper by Cisco on
best security practices at http://www.cisco.com/en/US/tech/tk869/tk769/technologies_white_paper09186a008014f945.shtml
...