Network and remote access
Review and management of agreed firewalls, remote access and network segmentation.
Managed cybersecurity for Hong Kong businesses of different sizes. We agree what needs protecting, who is responsible and how the work will be reviewed.
For businesses that need ongoing security management, a review of current IT support, or clearer ownership of security work.
Each item is confirmed in the engagement scope.
Review and management of agreed firewalls, remote access and network segmentation.
Management of agreed endpoint protection, access controls and update schedules.
Review and escalation of relevant security alerts during contracted coverage hours.
Records of completed work, outstanding risks and priorities, including backup checks where contracted.
A clear starting point for small businesses without a dedicated firewall: establish basic network-boundary protection with annual equipment rental and management.
Equipment models, basic usage rights, management scope and service hours are confirmed in the formal quotation and contract. Advanced plan amounts are proposed prices.
The PDF covers the three standard MFS plans. Compliance support and hardware options are quoted separately.
Each plan includes the rental of 1 physical firewall and agreed management for 1 site. The model, rule complexity and access arrangements must be checked first.
12 months paid annually in one payment. Monthly figures are equivalents only; monthly payment is not available.
Rental equipment, not a purchase. The equipment belongs to GDMME; renew the rental or return it at expiry. Detailed contract terms are agreed separately.
These prices cover MFS equipment rental and firewall management. MSS endpoint, account and other management services are quoted separately.
Within the selected plan’s agreed firewall-management scope and service hours
First standard on-site installation included · up to 4 hoursHK$850/ month equivalent
Annual paymentHK$ 10,200Equipment rental + management
Entry annual price
First standard on-site installation included · up to 4 hours
For small businesses without a dedicated firewall, starting with basic network-boundary protection and routine maintenance.
Within the selected plan’s agreed firewall-management scope and service hours
At vendor security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid rental contract.
Routine checks are the focus. Major changes are quoted separately.
Enquire about this plan — Routine maintenanceHK$1,280/ month equivalent
Annual paymentHK$ 15,360Equipment rental + management
Proposed price · confirmed in the formal plan
First standard on-site installation included · up to 4 hours
For routine rule changes and remote-access needs.
Within the selected plan’s agreed firewall-management scope and service hours
At vendor security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid rental contract.
For a single site with routine configuration changes.
Enquire about this plan — Rules and VPN managementHK$2,480/ month equivalent
Annual paymentHK$ 29,760Equipment rental + management
Proposed price · confirmed in the formal plan
First standard on-site installation included · up to 4 hours
For more complex firewall policies that need review.
Within the selected plan’s agreed firewall-management scope and service hours
At vendor security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid rental contract.
More in-depth management. Additional equipment is quoted separately.
Enquire about this plan — Advanced policy managementScope support with your IT and compliance leads around your licence, business systems and existing controls.
Review firewall rules, network segmentation and remote access; arrange multi-factor authentication where supported.
Explore network controlsReview permissions, updates and equipment support lifecycles. Huorong licensing and endpoint management are quoted separately as needed.
Explore accounts and endpointsOrganise access reviews, change approvals, maintenance and log records. Agree retention periods and access scope in advance.
Explore audit recordsReview backup records, recovery and incident arrangements. Scope actual recovery tests or exercises separately.
Explore recovery preparationStart with your confirmed requirements, review the current position, arrange improvements and keep traceable work records. Agree each task and deliverable before the engagement.
Scoped to the engagementNetwork and access inventory, rule review, change approvals and test records.
Access review, device version and lifecycle inventory, and update follow-up records.
Evidence index, change records and improvement tracker, updated at the agreed frequency.
Backup and recovery summary and incident contact checklist; test results depend on separately agreed work.
Your compliance lead confirms the licence, applicable requirements, review objectives and timing.
List assets, current providers, scope and responsible owners, then confirm the quotation.
Configure, review or test within the authorisation, recording changes and outstanding improvements.
Provide a record index and action tracker; agree the next review and handover.
These are deliverable formats we can agree, rather than actual client reports. Content and frequency depend on the engagement.
No passwords, client data or full logs are needed for an initial enquiry. Agree authorisation and a secure delivery method if technical documents are required later.
Check applicability to your business and licence. These references do not imply regulatory approval of GDMME.
Your compliance lead confirms the applicable regulatory requirements. This service supports technical controls and audit preparation; it provides no regulatory certification or compliance guarantee.
Necessary basic software usage rights listed in the contract are included. Additional security-intelligence and commercial subscriptions are quoted separately; not all vendor subscriptions are included.
When contract-specified rental equipment reaches the manufacturer's security-support end date (EOL/EOS), equivalent replacement is arranged according to the vendor lifecycle and contract. Standard configuration migration is included within the agreed scope of the valid rental contract. Specification upgrades and major changes are quoted separately.
Help small businesses establish sustainable protection first, then add endpoint protection and broader management according to their needs.
Start with 1 rented firewall and agreed management for 1 site, with configuration, version and risk-follow-up records.
Add computer endpoint protection as needed, confirming licences, central management, endpoint deployment and follow-up arrangements.
Agree additional management tasks and responsibilities for accounts, data, backups and other business needs.
The annual entry package equivalent to HK$850 per month does not include Huorong Enterprise. Huorong licences, central management, endpoint deployment and management services are quoted separately. Feature compatibility and scope must be confirmed first.
Explore Huorong Enterprise endpoint protection| Compare rental and management scope | Routine maintenance | Rules and VPN management | Advanced policy management |
|---|---|---|---|
| Management basis | MFS ESSENTIAL1 firewall / 1 site | MFS BUSINESS1 firewall / 1 site | MFS ADVANCED1 firewall / 1 site |
| Remote support | MFS ESSENTIALUnlimited requests and work hours within the contract scope and service hours | MFS BUSINESSUnlimited requests and work hours within the contract scope and service hours | MFS ADVANCEDUnlimited requests and work hours within the contract scope and service hours |
| First standard on-site installation | MFS ESSENTIALIncluded, up to 4 hours | MFS BUSINESSIncluded, up to 4 hours | MFS ADVANCEDIncluded, up to 4 hours |
| Health, versions and configuration backups | MFS ESSENTIALMonthly routine checks | MFS BUSINESSMonthly routine checks | MFS ADVANCEDMonthly routine checks |
| Work summary and action list | MFS ESSENTIALMonthly | MFS BUSINESSMonthly | MFS ADVANCEDMonthly |
| Alerts and risk notices | MFS ESSENTIALReviewed during routine checks | MFS BUSINESSFollow-up during agreed hours | MFS ADVANCEDFollow-up during agreed hours |
| Firewall rule changes | MFS ESSENTIALSimple maintenance of existing settings | MFS BUSINESSChanges based on approved requirements | MFS ADVANCEDIncludes more complex access policies |
| Existing VPN maintenance | MFS ESSENTIALQuoted separately | MFS BUSINESSWithin the agreed scope | MFS ADVANCEDWithin the agreed scope |
| Segmentation rules and connectivity analysis | MFS ESSENTIALQuoted separately | MFS BUSINESSQuoted separately | MFS ADVANCEDWithin the agreed scope |
| Basic usage rights and additional subscriptions | MFS ESSENTIALContract-listed basic rights included; extra subscriptions quoted separately | MFS BUSINESSContract-listed basic rights included; extra subscriptions quoted separately | MFS ADVANCEDContract-listed basic rights included; extra subscriptions quoted separately |
| Rental equipment | MFS ESSENTIALContract-specified equipment included; not a purchase | MFS BUSINESSContract-specified equipment included; not a purchase | MFS ADVANCEDContract-specified equipment included; not a purchase |
| 12-month annual payment | MFS ESSENTIALHK$10,200 paid annually in one payment | MFS BUSINESSHK$15,360 paid annually in one payment | MFS ADVANCEDHK$29,760 paid annually in one payment |
| Vendor support lifecycle and replacement | MFS ESSENTIALAt security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid contract | MFS BUSINESSAt security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid contract | MFS ADVANCEDAt security-support end (EOL/EOS), equivalent replacement and standard configuration migration follow the valid contract |
IncludedFirst standard on-site installation included · up to 4 hours
The first standard on-site installation and initial configuration are included, up to 4 hours. Check compatibility, access, settings and backups; complete standard deployment and handover records within the contract scope. Extra cabling, complex or major migrations, new scope and upgrades are quoted separately.
HK$ 600per hour
Proposed price · confirmed in the formal plan
Proposed rate for work outside the agreed scope, billed in 30-minute units after fees are confirmed. Remote firewall work within the contract scope and service hours is not charged by request count or work hours.
First-year payment = the 12-month equipment rental and management fee. Includes the first standard on-site installation and initial configuration (up to 4 hours), plus unlimited remote requests and work hours within the contract scope and service hours. Additional subscriptions and confirmed out-of-scope work are charged separately.
These annual equipment rental and management fees are paid in one payment. The first standard on-site installation and initial configuration (up to 4 hours) are included. Remote requests and work hours are unlimited within the contract scope and service hours. Extra cabling, major migrations, upgrades, subscriptions and out-of-scope work are charged separately.
First standard on-site installation included · up to 4 hoursHK$ 10,20012-month annual fee
First-year payment totalHK$ 10,200
Entry annual price
First standard on-site installation included · up to 4 hoursHK$ 15,36012-month annual fee
First-year payment totalHK$ 15,360
Proposed price · confirmed in the formal plan
First standard on-site installation included · up to 4 hoursHK$ 29,76012-month annual fee
First-year payment totalHK$ 29,760
Proposed price · confirmed in the formal plan
Monday–Friday, 10:00–18:00 Hong Kong time, excluding public holidays. These are proposed service hours; response SLAs are not yet confirmed.
The service covers the agreed firewall only. Alert follow-up depends on available logs and service hours; it does not represent continuous monitoring or any security guarantee.
Frequency, responsibilities, service hours and any separately charged work are agreed before the engagement.
GDMME plans to integrate CrowdSec in stages and review and improve configurations over time, connecting attack behaviour in service logs with collaborative threat intelligence and enforcement in equipment and managed security proposals. Available functions and scope depend on each deployment’s configuration and validation results.
Analyse configured service logs against detection scenarios to identify attack behaviour and generate alerts and decisions.
Use CrowdSec threat intelligence according to deployment settings. Community signal sharing and the data involved will be agreed in the proposal.
Enforce decisions through compatible remediation components, with alert review, rule updates, allowlists and unblocking included where agreed in the managed scope.
Agree log sources and retention, compatible components, blocking and unblocking, false-positive handling, coverage hours and responsibilities. The proposal also explains threat intelligence and community signal sharing settings.
Agree log sources, compatible components, decision duration and follow-up responsibilities before deploying and validating detection through to enforcement.
WAF / AppSec can be assessed separately and requires compatible components and rules. Included functions will be specified in the proposal.
Huorong Enterprise is provided by distributor AL-TOUCH SOLUTIONS LIMITED 一大方案有限公司. Discuss licensing, control centre deployment, endpoint policies and ongoing management alongside GDMME network protection.
Review protection across office computers and important servers, distribute policies and follow up improvements centrally.
Group endpoints by department or role, review status, assets and security logs, and distribute protection policies. Confirm that endpoints are connected and policies have synchronised.
Use endpoint IP protocol controls to restrict inbound and outbound connections, alongside application network rules, so departments reach only required services. This policy-based endpoint segmentation needs business connectivity testing.
Enable dynamic authentication for the control centre. Supported endpoints can also require a dynamic code for local password sign-in and Remote Desktop sign-in. Scope this for compatible key servers; configure firewall and switch administration MFA separately where supported.
Review connected endpoints’ vulnerabilities, installed software and remediation status centrally, scheduling tested updates within maintenance windows. Coverage follows the supported catalogue and does not constitute a complete vulnerability scan of every application.
Apply policies to USB storage, USB wireless / wired adapters and other peripherals, with blocking and trusted-device exceptions. Supported storage can be read-only, reducing unauthorised connections and file introduction risks.
Restrict specified remote tools through execution controls and network rules. Software prohibition can separately log, prompt or isolate non-compliant endpoints according to policy. Validate application matching and retain an approved maintenance channel.
Segmentation example: finance PCs can use an approved application; general staff PCs cannot directly access finance PCs or core equipment administration ports.
Cross-department access restricted
Retain required business access
Huorong control centre → group policies → endpoint enforcement and logs
Illustrative rules, not live monitoring. Enable and synchronise policies on managed endpoints. Agentless devices, uncovered paths and core equipment also need network segmentation, access controls and other protection.
Dynamic authentication has version and account restrictions: local sign-in methods may change, and some high-risk operation checks exempt super administrators. Agree recovery and emergency access before deployment.
Functions vary by operating system, edition, licence and endpoint type. GDMME reviews compatibility and tests policies before agreeing deployment, service hours and deliverables.
GDMME aims to connect equipment, collaborative threat intelligence and local management in a clear service arrangement. Compare actual protection scope, licensing and follow-up ownership.
This explains GDMME’s proposed approach and questions to check in major-brand quotations. Vendors offer different deployment and managed options; compare the specific products, editions and service agreements.
| Dimension | GDMME + CrowdSec (planned approach) | Major-brand proposal (items to confirm) |
|---|---|---|
| Starting point | Scope around Hong Kong businesses’ equipment, working environment and management needs, documenting configuration and follow-up ownership. | Does the selected edition fit staff, sites and existing equipment? Who provides deployment and ongoing management? |
| Threat intelligence and detection | Plan behaviour detection from configured logs with CrowdSec, alongside community blocklists and selected intelligence subscriptions. | Which intelligence, detection engines and updates are included? Which require subscriptions? Can third-party intelligence be imported? |
| Deployment and enforcement | Select compatible remediation components and validate alerts, enforcement, allowlists and unblocking. | Which appliance, virtual, cloud or agent deployments are supported? How are throughput and feature limits defined? |
| Endpoint and network responsibilities | Plan layers across GDMME network equipment, CrowdSec integration and Huorong Enterprise; confirm endpoint licensing and functions separately. | What is included for firewall, EPP, EDR and WAF? Are integrations and licences included? |
| Management and support ownership | Document alert review, updates, handover records, service hours and escalation contacts in the GDMME engagement. | Is support owned by the vendor, distributor or managed team? Are coverage hours, response commitments and incident support agreed in writing? |
| Licensing and total cost | Itemise equipment, deployment, endpoint licences, selected CrowdSec intelligence / Console plans and management. An open-source engine does not make all data or commercial use free. | Compare licences, renewals, replacement, deployment and management for equivalent scope, including the impact of expiry or disabled features. |
Existing major-brand equipment can be assessed for compatible integration and management. GDMME proposes a scope around your current environment.
Clear boundaries make proposals easier to compare and day-to-day follow-up easier to manage.
Coverage hours, alert follow-up and response commitments must be confirmed in the proposal. A response commitment describes when follow-up starts; it does not mean that a problem will be resolved or data restored within that time.
Your company identifies the authorised decision-maker, business priorities and owners of systems and data. Approvals, safe access, current supplier coordination and agreed internal actions remain necessary.
Confirm changes to managed assets, locations, users, coverage or projects before work begins. Record the revised scope, responsibilities, timing and any additional fees.
Keep systems, responsibilities and open issues visible. Arrange the handover within the agreed scope.
Four steps. Select a step’s preparation items to read more.Review existing systems, suppliers and service arrangements to understand your needs and handover constraints.
Identify the services GDMME will take over, responsibilities and any work that is excluded.
Coordinate authorised account access, documentation and timing within the agreed scope.
Check the items handed over, record outstanding issues and follow up within the agreed service scope.
Clarify responsibilities first, then decide which services to retain, change or hand over.
Not necessarily. We first agree which services GDMME will take over. You may retain some services with your current supplier. Arrange any changes or termination with that supplier under your existing contract terms.
This illustrates a general handover process. Scope, timing and downtime depend on the existing environment, authorisation and supplier cooperation.
Yes. Responsibilities and access arrangements are agreed at onboarding. We can coordinate with your provider or plan a controlled handover.
We first review compatibility, support status and risk. Recommended replacements are explained and quoted before approval.
The proposal reflects users, devices, locations, existing systems and the agreed support level. Equipment, licences and separately charged work are identified in the scope.
List system names, contracts, your authorised decision-maker and known access arrangements. Use the appropriate contractual and authorised route to obtain the necessary information, then plan access changes. Do not submit passwords or verification codes.
Review which data is covered, available versions, access permissions and actual restoration-test results. Synchronisation may also copy deletions or changes. Recovery against your business needs requires separate verification.
Yes. Describe your current arrangements and what you want to improve. The next step may be clarifying responsibilities, an independent review or a discussion about handover and ongoing management. A complete technical report is not needed for the first enquiry.
These independent educational resources support general preparation. They do not imply a partnership, accreditation or endorsement of GDMME. Check the original guidance for its scope and publication date.
Share your company size and a brief description. We will confirm the possible next steps.