网络安全

安全远程访问 (VPN/ZTNA)

员工和外包人员通过 VPN 或 ZTNA 加 MFA 随时随地访问内部系统，只能看到所需内容。

现场常见问题

RDP open straight to the internet and password-only VPN are among the most common ways ransomware gets in. And once someone is on the VPN, they can usually see the whole network when all they needed was the ERP.

There are two approaches, and many organizations use both.

VPN (IPsec/SSL), set up properly

Enforce MFA on every account (authenticator app or FIDO2 key), tied to AD/Entra ID
Restrict by group: finance reaches only the ERP, contractors only named hosts
Close internet-facing RDP/SMB and patch VPN firmware as soon as a vulnerability is published. VPN appliance flaws being exploited within days of disclosure is normal now.

For an organization with a modest number of remote users, a VPN that does these three things well is enough.

Zero Trust Network Access (ZTNA)

ZTNA doesn't trust the network. On every connection it checks identity and device state (OS patched, EDR running, disk encrypted) and opens only the applications that person is entitled to. Users never see the internal network, so if their laptop is infected, lateral movement is much harder.

Admins and vendors

A software vendor supporting you from Thailand or elsewhere shouldn't have a permanent VPN account. We recommend a jump host or a privileged-access tool that grants time-limited access and records the session, so you can check afterwards what was done.

功能

MFA on every login

A leaked password alone gets nobody in. App or FIDO2.

Device posture checks

Only patched devices running EDR get in.

Per-application access

Users see only the systems they need.

Identity integration

Active Directory, Entra ID or Google Workspace.

Time-limited vendor access

Expires on its own; sessions are recorded.

Access logs

Who accessed what, when and from where.

设计与实施

1
List apps, user groups and whatever is exposed today
2
Close exposed RDP/SMB and switch on MFA
3
Define access by group and device posture
4
Deploy VPN/ZTNA gateway or connectors and agents
5
Pilot with a small group, then roll out

适用场景

Executives and sales staff moving between Laos and Thailand
Engineers at mine or construction sites opening ERP and drawings
Software vendors supporting bank or hospital systems
Staff who work from home some days

常见系统规模

Secure VPN

适用于: Up to 50 remote users

SSL/IPsec VPN on your existing firewall
MFA and group-based access
Exposed RDP closed

获取报价

Zero Trust

适用于: Organizations with a regular remote workforce

ZTNA agent with posture checks
Per-application policies
Entra ID/Google integration

获取报价

Privileged & Vendor

适用于: Banks, government or critical systems

Jump host and session recording
Time-boxed vendor access
Monthly access report

获取报价

我们供货并安装的品牌

Fortinet Palo Alto Networks Cisco Check Point Sophos WatchGuard Microsoft Zyxel Networks SonicWall

所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。

常见问题

Is ZTNA really better than VPN?

ZTNA restricts access more finely and checks the device every time. But for a 30-person company with five remote staff, a VPN with MFA and tight permissions is a perfectly sensible answer.

Is RDP with a strong password enough?

No. Internet-facing RDP is scanned and password-sprayed around the clock. Only reach it through VPN or ZTNA with MFA.

Does it work on phones?

Yes. Most clients support Windows, macOS, iOS and Android. On personal phones we suggest opening only email and the apps people actually need.