CybersecuritySecure Remote Access (VPN/ZTNA)
Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
What we usually find on site
RDP open straight to the internet and password-only VPN are among the most common ways ransomware gets in. And once someone is on the VPN, they can usually see the whole network when all they needed was the ERP.
There are two approaches, and many organizations use both.
VPN (IPsec/SSL), set up properly
- Enforce MFA on every account (authenticator app or FIDO2 key), tied to AD/Entra ID
- Restrict by group: finance reaches only the ERP, contractors only named hosts
- Close internet-facing RDP/SMB and patch VPN firmware as soon as a vulnerability is published. VPN appliance flaws being exploited within days of disclosure is normal now.
For an organization with a modest number of remote users, a VPN that does these three things well is enough.
Zero Trust Network Access (ZTNA)
ZTNA doesn't trust the network. On every connection it checks identity and device state (OS patched, EDR running, disk encrypted) and opens only the applications that person is entitled to. Users never see the internal network, so if their laptop is infected, lateral movement is much harder.
Admins and vendors
A software vendor supporting you from Thailand or elsewhere shouldn't have a permanent VPN account. We recommend a jump host or a privileged-access tool that grants time-limited access and records the session, so you can check afterwards what was done.
What it does
MFA on every login
A leaked password alone gets nobody in. App or FIDO2.
Device posture checks
Only patched devices running EDR get in.
Per-application access
Users see only the systems they need.
Identity integration
Active Directory, Entra ID or Google Workspace.
Time-limited vendor access
Expires on its own; sessions are recorded.
Access logs
Who accessed what, when and from where.
Design and rollout
- 1
List apps, user groups and whatever is exposed today
- 2
Close exposed RDP/SMB and switch on MFA
- 3
Define access by group and device posture
- 4
Deploy VPN/ZTNA gateway or connectors and agents
- 5
Pilot with a small group, then roll out
Where it fits
- Executives and sales staff moving between Laos and Thailand
- Engineers at mine or construction sites opening ERP and drawings
- Software vendors supporting bank or hospital systems
- Staff who work from home some days
Typical system sizes
Secure VPN
Fits: Up to 50 remote users
- SSL/IPsec VPN on your existing firewall
- MFA and group-based access
- Exposed RDP closed
Zero Trust
Fits: Organizations with a regular remote workforce
- ZTNA agent with posture checks
- Per-application policies
- Entra ID/Google integration
Privileged & Vendor
Fits: Banks, government or critical systems
- Jump host and session recording
- Time-boxed vendor access
- Monthly access report
Brands we supply & install
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
FAQ
Is ZTNA really better than VPN?
ZTNA restricts access more finely and checks the device every time. But for a 30-person company with five remote staff, a VPN with MFA and tight permissions is a perfectly sensible answer.
Is RDP with a strong password enough?
No. Internet-facing RDP is scanned and password-sprayed around the clock. Only reach it through VPN or ZTNA with MFA.
Does it work on phones?
Yes. Most clients support Windows, macOS, iOS and Android. On personal phones we suggest opening only email and the apps people actually need.
Related guides
Secure Remote Access: When VPN Is Enough and When to Move to ZTNA
How remote-access VPN and Zero Trust Network Access differ in practice, what to fix in your current VPN first, and how to handle vendors who want remote access.
Password Policy and MFA: Stop Forcing 90-Day Password Changes
Several classic password rules make organizations less secure. A policy based on the current NIST SP 800-63B, a comparison of MFA types, and a rollout order that works…
Ransomware Checklist: Breaking the Attack at Each Stage
Ransomware is not a one-minute event. A checklist organized around the stages attackers actually go through, plus what to do in the first hour.
A Data Privacy Checklist Before You Put Company Documents Into Any AI
Before staff paste a contract, invoice or customer list into any AI tool, there is a sequence to check: classify the document, know where the AI runs, who holds an…
Sizing a Firewall: What Really Separates UTM from NGFW
Why the internet slows down after a new firewall goes in, which datasheet number to size against, and what to check before paying when the unit ships from Thailand to…
Private AI vs Cloud AI: How to Choose for Your Organisation
What changes between running AI on your own server and using a public cloud AI service — data sensitivity, internet dependence, control and upkeep — with a simple…
Related solutions
Cybersecurity
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
Email SecurityStop phishing, fake boss and fake supplier emails (BEC) and malicious attachments with filtering, SPF/DKIM/DMARC and sandboxing.
Zero Trust & Network Access Control (NAC)Check every user and device before it joins, with 802.1X and NAC. Plugging into a LAN port no longer means reaching the servers.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
Vulnerability Assessment & Penetration TestingScan and test systems, websites and networks to find weaknesses before someone else does, with a report ordered by what to fix…Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.