GDMME Whitepaper
See risk clearly. Put protection and management on a sound footing.
Businesses need more than alerts. They need to know what deserves attention, who will follow up and how to check the outcome. The GDMME approach connects firewall management, central monitoring and client reporting into a clear workflow for everyday protection and incident recovery.
Agree the scope, organise the work and retain the results so each next step has a sound basis.
See risk clearly and reduce the management burden
Turn scattered connections, events and outstanding tasks into understandable information, so owners can focus on work that needs attention. The table sets out the GDMME management approach and checks.
The single-device firewall management interface is implemented; central monitoring is currently a local demonstration with simulated data and no actual devices connected.
On a narrow screen, scroll within the table.
| Management focus | Purpose for clients | What to check |
|---|---|---|
| Everyday firewall management | Bring operations and events together | Validate the deployed device and record coverage so daily checks have a clear basis. |
| Suspicious-connection context | Clarify clues worth following up | Review connection context and list comparisons together. Lookup results do not confirm an attack. |
| Monitoring across devices and sites | Reduce scattered checks and duplicate follow-up | Review device status, event priorities, repeated alerts and missing data. |
| Dedicated client reports | Review outcomes and outstanding work | Help clients understand their own status, owners and next steps. |
From device records to a clear report
The GDMME firewall brings together daily operations and event information for one device. Central monitoring puts multiple devices and sites in one working view. Client reports organise relevant risks, action outcomes and next steps.
- GDMME FirewallOrganise one device’s operations and eventsDaily device management
- Central monitoringBring devices, sites and outstanding work togetherReduce scattered checks
- Client reportsClarify outcomes, owners and next stepsSupport review and follow-up
Begin with monitoring and reporting. Authorised staff approve device changes separately. Initial central monitoring excludes batch rule changes, updates and device restarts.
Dedicated client reports: priorities and next steps
Reports help clients understand their own devices and sites: what was observed, how it was handled, what remains unconfirmed and who will follow up. They support reading and review, with separate permission for administrative actions.
- Understand events
- Show where data came from, the time covered and how it was counted. Separate alerts, blocking records and confirmed attack outcomes.
- Understand gaps
- Show the last update, missing data and monitoring coverage, so “online” or “no alerts” is not mistaken for a safety conclusion.
- Understand responsibilities
- List outstanding work, owners and review arrangements. Each client can read only their own authorised data.
Make action outcomes understandable
- Red · Blocked
- Green · Passed
- Amber · Unknown
Pair colour with text and records. “Passed” means that connection or action was allowed; it is not a safety assessment of the whole environment.
Dedicated client reports will open after validation of sign-in, data permissions and result accuracy.
Ransomware resilience: prevention and recovery
Protection should reduce opportunities for intrusion and spread, while preparing for business disruption. Networks, devices, accounts, backups and incident response need to work together, with clear ownership.
Network connections
Separate work areas, restrict remote access and retain connections the business needs to reduce opportunities for problems to spread.
Work devices
Keep systems and applications updated, use device protection and application restrictions, and check which devices are managed.
Account permissions
Grant access by work need, strengthen identity checks for important sign-ins, separate administrative and everyday accounts, and promptly handle leavers and access changes.
Usable backups
Separate backups from everyday accounts and networks, retain earlier versions and resist unauthorised alteration or deletion. Keep an independent recovery route if company accounts are unavailable, and test it regularly.
Incident response and recovery
Agree contacts and response priorities. If a problem occurs, coordinate isolation, preserve evidence, then verify recovery scope and results against business needs.
Verifiable results make responsibilities clear
Use these recommended acceptance questions to agree the records your environment and service scope need. Name the owner, review date and outstanding work.
On a narrow screen, scroll within the table.
| What to confirm | Results clients should be able to check |
|---|---|
| Do alerts have recorded outcomes? | Retain event and action records that distinguish notification only, allowed, blocked and unconfirmed outcomes. |
| Can essential work still proceed? | Test essential and prohibited connections, record the results and obtain confirmation from business owners. |
| Can only the right people see the data? | Check sign-in and permissions; test that unauthorised users cannot read another client’s data or perform administrative actions. |
| Does protection affect everyday work? | Measure speed, delay and connection stability with the agreed devices, functions and workload. A stated connection speed does not replace testing. |
| Are reports current and complete enough? | Show update times, record retention, missing data and coverage to avoid using stale data to assess the present. |
| How are problematic changes reversed? | Retain configuration backups, rollback tests and update arrangements; assign responsibility for devices that lose support. |
| How is data retained and handled? | Agree data location, retention, usage permissions and data handling during service handover. |
| Can backups actually be restored? | Retain integrity and restore-test results. Business owners approve acceptable data loss and recovery time. |
Progress through verifiable steps
Clarify scope and responsibility, then validate devices, data and reports. Retain results at each step to support the next.
- Agree scope
01 · Clarify needs and responsibilities
List devices, sites, essential work, owners and required reports.
- Validate devices
02 · Verify protection and operations
Check events, action outcomes, business impact and rollback methods; retain test records.
- Validate data
03 · Establish reliable monitoring
Validate access and data permissions; establish update times, gaps and how alerts are organised.
- Review reports
04 · Support ongoing follow-up
Confirm clients see only their own authorised data and that reports explain outcomes, owners and next steps. Use validation results to agree the opening scope.
Common client questions
What management problems does GDMME aim to address?
Make devices, events and outstanding work clearer, help owners set priorities and use records to verify follow-up. Scope and responsibilities are agreed for each engagement.
Are device protection and backups all included?
Confirm protection tools, backup platforms, licences and implementation work individually. The recommendations here do not mean every item is included in every service plan.
Does an alert mean the event was blocked?
An alert may mean only that the system issued a notification. Verify blocking against the event’s actual action record; mark the outcome unknown if evidence is missing.
Is the alert count the number of successful attacks?
No. Alerts may repeat or be false positives. Read them alongside their source, time window and action outcome to identify work that needs follow-up.
Do online status, green indicators or no alerts mean safety?
These states alone cannot establish safety. Green passed describes one action; no alerts may reflect missing data. Reports need visible coverage and update times.
Can a network location identify an attacker?
No. Relay services or compromised devices may obscure the source. Geography is a clue and cannot alone establish identity or nationality.
Is ransomware prevention or successful recovery guaranteed?
Protection needs devices, accounts, networks, backups and incident response to work together. It cannot guarantee prevention of every threat or decryption. Restore tests help assess readiness; successful restoration does not rule out prior data theft.