CYBERSECURITY EDUCATION

Understand the layers
Practise everyday protection

Understand network and endpoint protection, then practise payment, account and file-risk awareness. Free learning for Hong Kong businesses; no sign-in required.

GDMME / 公開工具

HTTPS protects the connection
Business identity still needs checking

In the age of AI-enabled scams, encryption is only part of the picture. Know who you are dealing with.

Check a certificate and identity clues

Public tool · No sign-in · Local processing

Public ransomware tool

Review ransom-note and file clues for free, with data processed only in your browser.

Start a local initial check

NETWORK & ENDPOINT

Firewall and EDR: which layer do they protect?

A Firewall controls traffic that passes through it. EDR observes activity on computers to support investigation and response. Explore the two layers using a GDMME rack and Huorong enterprise endpoint security as examples.

Choose the protection setup

Select a setup below to compare protection layers

Choose a scenario

Select a scenario to see how the threat unfolds

↻ Repeat: always on

The animation repeats continuously. Selecting a setup, scenario or step keeps it playing. Replay starts the sequence again.

Alt +Enter Full screenEsc ExitHover over or focus within this lesson to use the shortcut.

Threat and traffic sourceNetwork layer · FirewallEndpoint layer · Endpoint securityInbound / Outside to inside

The diagram keeps a readable scale. Scroll sideways within it to see the computers, or focus the diagram and use the arrow keys.

01 / 04

Threat source

An external attacker attempts an unauthorised connection

Denied at gateway

Disclaimer / Teaching illustrationExample setup and scenario：Both layers · Hacker connection attempt

Red, orange and green indicate the configured layers, not security ratings or live status. Both layers do not guarantee protection against every attack. Actual capabilities and outcomes depend on product edition, licensing, rules, updates and ongoing management. Reachability, alerts and successful compromise are different states.

With a Firewall, what still needs attention?

Internal activity may bypass the gateway

Peer traffic may not cross the gateway Firewall. Internal segmentation, permissions and endpoint visibility are needed.

Allowed traffic can still carry risks

Attachments or cloud services can arrive over allowed connections. Gateway rules alone do not establish file safety.

Valid accounts still need controls

Mistakes, stolen accounts and improper sharing also need least privilege, auditing and data protection.

What does this scenario show?

The example connection is denied at the network layer

Network layer

This example assumes a matching deny rule is configured. The Firewall rejects the connection at the gateway.

Endpoint layer

Endpoint agents remain available to observe host activity. This example connection was already denied at the gateway.

Understand the two layers

Firewall / Network firewall

Where it runs: A network gateway or segmentation point, such as GDMME equipment in the rack.
What it observes: Traffic passing through it, sources, destinations and enabled traffic inspection.
How it responds: Allow or deny traffic under policy, with segmentation and logging.
What complements it?: Host activity may not pass through the network Firewall, so endpoint observation is still needed.

EDR / Endpoint detection and response

Where it runs: Endpoint agents on the computers or servers included in the deployment.
What it observes: Host processes, files and behaviour records to help connect incident evidence.
How it responds: Raise alerts, investigate incidents and take supported, authorised response actions.
What complements it?: Endpoint agents complement gateway rules, segmentation and ongoing management.

Are antivirus, endpoint security and EDR the same?

Assess capabilities as well as labels. Antivirus includes identifying and handling malicious files. EDR focuses on endpoint detection, investigation and response. Huorong is an enterprise endpoint-security example here; full EDR, event history and isolation capabilities must be confirmed for the edition, licence and proposal.

Is management still needed with both layers?

Yes. Rules, updates, alert follow-up and asset scope need ongoing management, alongside account protection, backups and staff reporting.

Public references and product guidance

NIST: Firewall definitions Microsoft: EDR capabilities Huorong: Enterprise products

Discuss network and endpoint protection

HUORONG / BUSINESS ENDPOINT SECURITY

Huorong Enterprise: bring endpoint management together

Huorong Enterprise is provided by distributor AL-TOUCH SOLUTIONS LIMITED 一大方案有限公司. Discuss licensing, control centre deployment, endpoint policies and ongoing management alongside GDMME network protection.

Huorong Enterprise is provided by distributor AL-TOUCH SOLUTIONS LIMITED 一大方案有限公司

Review protection across office computers and important servers, distribute policies and follow up improvements centrally.

Explore Huorong Enterprise and management functions Huorong Hong Kong website ↗

OPEN SECURITY EDUCATION

Practise firstThen make your judgement

From how attacks begin to how to limit their impact. Choose a scenario and practise your next step.

Free to use · No sign-in required

Scenario 02 / Simulation

Shared files suddenly will not open

Not answered yet

01 / READ THE SCENARIO AND CLUES

A ransom message appears on your computer and several shared files will not open. A colleague has the same problem, and the backup drive is on your desk.

Show a hint

Do not rush to restart or connect a backup. Isolate affected devices and report the incident first to avoid spreading the impact or damaging investigation evidence.

An attack may start with stolen accounts, phishing content or unpatched vulnerabilities. Not every incident begins with a staff member clicking by mistake.

A simplified path, not live monitoring or an inevitable sequence for every incident

Prevention: next steps for staff and the company

What staff can do now

Record when you noticed the issue and what the screen says. Do not clean up, delete files or reinstall anything yourself.
Contact IT using another trusted device or a known phone number, and follow your company's incident procedure.

What the company needs to arrange

Keep backups isolated from the everyday environment or protected against tampering, and regularly test restoration.
Patch vulnerabilities, configure endpoint detection and response (EDR) and centralised logs, and prepare isolation and recovery procedures in advance.

An HA active/standby pair mainly maintains service availability; it cannot replace ransomware prevention. Backups can help with recovery but cannot remove the risk of data already being leaked.

Learn about account protection and 2FA

Scenario 03 / Simulation

How can one compromised computer affect the whole company?

Not answered yet

01 / READ THE SCENARIO AND CLUES

A staff computer is compromised. The attacker tries to use the stolen account to access shared files, servers and backups. Expanding access inside the network in this way is called “lateral movement”.

Show a hint

A firewall at the company's internet gateway does not mean access between internal devices is restricted. Shared administrator accounts may also increase the impact.

Assume this computer is already compromised. Isolation and permission restrictions can still help reduce further impact.

In this example, the stolen account can attempt to access servers and backups.

A simplified path, not live monitoring or an inevitable sequence for every incident

Prevention: next steps for staff and the company

What staff can do now

Do not share accounts or passwords, or use administrator accounts for everyday work.
Check unexpected sign-in or privilege-elevation requests with IT first.

What the company needs to arrange

Separate staff devices, servers, backups and guest networks, and enforce rules allowing only necessary connections.
Apply least privilege and separate administrator accounts, and monitor unusual sign-ins and access across devices.

The segmentation rules in this example deny the stolen account access to servers and backups. Actual effectiveness depends on permissions, rules and configuration; creating VLANs alone is not enough.

Practise verifying external support staff

Suspect a compromise? Start with these three actions

Isolate: If you suspect a computer is infected, unplug its network cable and turn off Wi-Fi. Do not connect backup devices.
Report：透過已知電話聯絡 IT／資安負責人按公司的事故程序協調處理
Preserve: Record the time and on-screen messages. Do not delete files or reinstall the system yourself, as this may affect the investigation.

View the cybersecurity support process

0 / 3 scenarios practised

Does someone in your company own these protections?

Ask the responsible person to check anything uncertain, then decide what improvements are needed.

Sources and teaching scope

Compiled: 2026-10-08. These are original simulated scenarios, not client cases. Protection requires correct configuration, monitoring and incident response; it does not mean absolute security.

The interactive illustrations require JavaScript. You can still read the first scenario and expand the prevention advice, or contact us viaweb@gdmme.com for enquiries.

SPOT THE CLUES / Phishing email challenge

Spot the difference,pause in time.

80 phishing scenarios and 8 everyday notices. Find the clues, then choose your next step. After answering, see the explanation within the email.

0/ 88 practisedProgress on this page visit

Practice topic

1 / 88Find the clues before making your judgement

GDMMEMAIL LAB

Teaching example

Inbox88 practice emails

Further learningDomain identification, SPF/DKIM/DMARC and email headers

LOOK DEEPER / Advanced checks

After checking the name,check the authentication results.

SPF, DKIM and DMARC check the relationship between sources and domains; they do not authorise payments, logins or data sharing for you.

Spot lookalike characters

GOOGLE and G00GlE
Did you look closely?

Watch for the number 0, the letter O, lowercase l and uppercase I. Domains are case-insensitive; changing the case alone does not create a different domain.

Known brand spelling · Not a full URLGOOGLE

Lookalike characters · Not the official spellingG00GlE

Practice URLs use the reserved .example/.invalid domains. Check the full hostname, not just a brand name or HTTPS.

Authentication lesson for this emailExpand the simulated email headers and select each explanation

The headers below were written for training; they are not live verification results. For real analysis, IT should check results added by a trusted receiving server; senders can forge header text.

Pass does not mean trustworthy; Fail also needs investigationConsider authentication, business context and the request together

SPF: Who is authorised to send?

Checks whether the sending server is authorised by the envelope sender domain; it does not directly verify the visible From identity. Forwarding may cause a failure.

DKIM: Which content was signed?

Verifies the signing domain and the integrity of the signed parts. Pass does not mean the content is harmless or guarantee that the account has not been compromised.

DMARC: Does it align with From?

At least one of SPF or DKIM must pass, and its domain must align with the visible From domain. A lookalike domain can also set up valid authentication for itself.

Next steps for IT

Keep the original email and send it to IT through your company reporting channel. Consider trusted headers, forwarding records and business context together; do not allow an attachment just because you see Pass.

Add an email to practise reading headersPaste the source or choose an .eml file · Processed only on this page

Remove personal and company-sensitive information first. This tool only organises text; it does not detect malware or determine authenticity. It does not send data to a server, execute HTML, load images or open attachments.

Raw email headers or plain-text content

Choose .eml / .txt

Maximum 200 KB. MIME, HTML and attachments remain as raw text; they are not decoded or rendered.

Further readingGoogle: Email authentication Microsoft: SPF, DKIM and DMARC Google: View full headers

ONE PASSWORD. TWO DIFFERENT OUTCOMES.

After a password leak,
who else can log in?

One password, two protection settings. Follow the simulated login to see where the second factor makes a difference.

Original scenario illustration · Not a real attack record

2FA

Verify identity using two types of factor, such as a password and an authenticator. MFA is the general term for multi-factor authentication; entering two passwords is not 2FA.

2FA / INTERACTIVE COMPARISON

What changes when a password is exposed

Training assumptions

The attacker has only your correct password and is trying to log in from an unfamiliar device. They do not have the second factor or an authenticated session. This example does not simulate other login restrictions.

Start when ready · Pause or read step by step

Ready to compare: the same correct password, two different account settings.

PASSWORD ONLY

Without 2FA

One factor

Ready to compare

1Correct password
2No second factor
3Mailbox access

Login protected by a password alone

Start the demonstration to see what could happen after a password leak.

TWO-FACTOR AUTHENTICATION

With 2FA

Two types of factor

Ready to compare

1Correct password
2Another factor is required
3Unable to complete login

Verify identity beyond the password

This demonstration assumes a password plus a second factor is correctly enabled and enforced.

TRY A REAL-LIFE DECISION / Your turn

You are not logging in,
but your phone asks you to approve a login.

what would you do?

Choose a response to see why.

KEEP THE NEXT LAYER IN VIEW

After enabling it,
keep protecting your account.

What should I watch for even with 2FA?

Do not share verification codes or approve logins you did not initiate. Some authentication methods can still be phished through fake login pages. An infected device or a stolen authenticated session may also allow account misuse.

Still report a password leak, and use a known official entry point to manage your password, login records and suspicious sessions. Do not keep clicking a suspicious page to test whether it is genuine.

How do SMS, authenticators and passkeys differ?

One-time codes from SMS and authenticator apps can both be phished. Notifications that only require tapping Approve can also be exploited through repeated prompts.

On supported platforms, consider phishing-resistant methods such as Passkey/FIDO2. Whether they meet multi-factor requirements, how devices are protected and how access is recovered must be checked against the actual configuration.

How can I recover my account if I lose my phone?

Use an approved recovery method set up in advance and contact IT through a known channel. Store recovery codes securely and do not give them to callers without proper verification. Administrators also need to verify your identity so that recovery does not become a way to bypass authentication.

CISA: Multi-factor authentication guidance for businesses ↗Microsoft: Session and token protection ↗

ASK FOR A CLEAR ANSWER / Review current management

Can your IT provider
clearly explain your account protection?

Ask the person responsible to confirm which accounts have enforced protection, which have exceptions and how to recover access safely after a lost phone. Make responsibilities for setup, checks and follow-up clear.

Ask about account security management

View the company account protection checklist0 / 6

Authentication requirements for important email, VPN and administrator accounts have been confirmed.Policy enforcement has been checked, with exceptions and responsible owners listed.The process for removing leavers’ accounts and unused authentication methods has been confirmed.It is clear who reviews unusual login records and how they follow up.Procedures for lost phones, account recovery and identity verification have been defined.Staff know not to share verification codes or approve unfamiliar requests.

Tick items only after checking them; refer anything unclear to the person responsible for follow-up.

Ticks are kept only on this page. This is not a system scan, compliance score or guarantee of account security.

OPEN SECURITY EDUCATION

50 scenarios
Practise every decision

Choose a topic and start the exercise. Submit your answer to see the safer action and its explanation.

01 / CHOOSE A TOPIC

Preparing questions

0 answered · 0 correct

Answers are kept only on this page. Refreshing, reshuffling or changing topics resets this round’s results. No login or contact details required.

02 / YOUR TURN

Question preview

Preparing questions

Start the exercise, select an answer in the window, then confirm your choice.

Not answered yet

Choose a topic
Choose and confirm
Review the result

Original GDMME scenarios informed by public cybersecurity guidance. They do not test devices or rate business security.

Reference:CISA anti-phishing guidance. In-depth materials are available to authorised clients.

Bring practice into your company’s workflows

Learn how to arrange security awareness training for finance, administration and general staff.

Ask about company training

Understand the layersPractise everyday protection

HTTPS protects the connectionBusiness identity still needs checking

Public ransomware tool

Firewall and EDR: which layer do they protect?

Choose the protection setup

Choose a scenario

An external attacker attempts an unauthorised connection

With a Firewall, what still needs attention?

Internal activity may bypass the gateway

Allowed traffic can still carry risks

Valid accounts still need controls

The example connection is denied at the network layer

Network layer

Endpoint layer

Understand the two layers

Firewall / Network firewall

EDR / Endpoint detection and response

Huorong Enterprise: bring endpoint management together

Practise firstThen make your judgement

A supplier suddenly changes its bank account

What staff can do now

What the company needs to arrange

Shared files suddenly will not open

What staff can do now

What the company needs to arrange

How can one compromised computer affect the whole company?

What staff can do now

What the company needs to arrange

Does someone in your company own these protections?

Five-point business protection self-check

Spot the difference,pause in time.

After checking the name,check the authentication results.

GOOGLE and G00GlEDid you look closely?

After a password leak,who else can log in?

What changes when a password is exposed

Without 2FA

With 2FA

You are not logging in,but your phone asks you to approve a login.

Can your IT providerclearly explain your account protection?

50 scenariosPractise every decision

Question preview

Client Learning Centre

Bring practice into your company’s workflows

Understand the layers
Practise everyday protection

HTTPS protects the connection
Business identity still needs checking

GOOGLE and G00GlE
Did you look closely?

After a password leak,
who else can log in?

You are not logging in,
but your phone asks you to approve a login.

Can your IT provider
clearly explain your account protection?

50 scenarios
Practise every decision