From risk assessment to everyday protection.
As a Hong Kong cybersecurity company, AL-Touch provides firewall configuration, vulnerability scanning, managed security services (MSS), risk assessment and incident response, connecting technical controls with daily operations.
Assess risks
Inventory systems, permissions and public services, arranging authorised vulnerability scans and remediation priorities.
Deploy protection
Combine firewalls, endpoint and application security with segmentation and backup/recovery needs.
Ongoing management
Arrange updates, alert follow-up and incident-response responsibilities within the MSS scope.
Start with existing equipment and staff, defining work and support arrangements to help reduce operating costs and risks.
Explore MFS managed firewallsPEOPLE · PROCESS · TECHNOLOGY
Cybersecurity is an ongoing business capability
Start with critical operations, information and owners: identify risks, implement controls, review them regularly and prepare response and recovery. Firewalls and endpoint protection are tools within this approach, alongside processes, permissions, backups and staff practices.
Governance and risk assessment
Identify critical operations, assets and suppliers, then agree responsibilities, relevant requirements and improvement priorities.
- Evidence to review
- Asset inventory, risk register, scope of work and assigned responsibilities.
Identity, access and data
Manage user and service accounts, MFA, least privilege, data classification and the information available to AI tools.
- Evidence to review
- Permissions matrix, account reviews, data flows and retention rules.
Network, endpoint and application protection
Combine segmentation, firewalls, endpoint controls, patching, WAF and API security according to risk, and verify business compatibility.
- Evidence to review
- Configuration baselines, change records, test results and approved exceptions.
Continuous monitoring and vulnerability management
Collect relevant logs, review exposures and vulnerabilities, triage alerts and track fixes and retests.
- Evidence to review
- Coverage maps, remediation tracking, alert records and retest results.
Incident response and recovery
Plan reporting, containment, evidence preservation and supplier coordination; test recovery through restoration and exercises.
- Evidence to review
- Response procedures, recovery objectives, restoration tests and improvement reports.
People, processes and supply chains
Build security into onboarding, offboarding, remote work, procurement and everyday tasks, supported by training and supplier access management.
- Evidence to review
- Staff guidance, exercise records, supplier permissions and periodic reviews.
Assess first, then improve in stages
- Understand requirementsCritical systems, data, owners and current issues
- Agree a planPriorities, product selection, budget and delivery responsibilities
- Deploy and acceptTest controls, document exceptions and hand over operations
- Maintain and improveUpdates, monitoring, exercises and improvement records
The service structure draws on NIST CSF governance, identification, protection, detection, response and recovery. Work is scoped to the business environment and agreed requirements.NIST CSF reference ↗
Staff protection before an incident
- Recognise unfamiliar emails, attachments and web links
- Use approved software, devices and accounts; do not share login credentials
- Lock computers when away and follow policies for external storage
Management and technical arrangements
- Arrange security awareness training and response exercises
- Identify incident contacts, accountable people and authorisation limits
- Regularly review patches, updates, permissions and backup recovery
- Assess external software providers and remote access
During and after an incident
Record when a suspected intrusion was discovered, its impact and visible symptoms, then notify authorised personnel through the agreed process. Decisions on shutdown, isolation and evidence collection depend on the situation. Avoid unauthorised deletion or resets that could affect investigation. After recovery, review the entry route, permissions and outstanding remediation.
Lessons from a ransomware incident in 2020
A historical case records encrypted business computers and servers, with an external backup connected to the server also affected. Key management issues included legacy system patching, exposed external RDP, supplier access and backup isolation.
The old versions, encryption settings and account practices in that case should not be copied as current standard configurations. Validate them against present system requirements.
Connect staff guidance with technical controls and response responsibilities
Define the roles of staff, management and technical teams before, during and after an incident. Alongside recognising suspicious emails and protecting accounts, review patching, remote permissions, backup recovery and third-party access. Preserve evidence and notify responsible personnel through the agreed process, avoiding unauthorised deletion or resets that could affect an investigation.
Information and references
Related solutions and services
AL-Touch helps offices in Hong Kong and mainland China deploy dedicated servers and business systems. We coordinate hosting resources, connectivity, administrative access and backups so colleagues across locations have clear access and support arrangements.
When is this service suitable?
Common needs
- Business growth calls for clearer protection of computers, networks and administrator accounts.
- Security equipment exists, but responsibility for configuration and alerts is unclear.
- Customers ask about data protection, and you need to review current arrangements.
Which service do I need?
- GDMME cybersecurity solutions
Explore network defence and deployment scenarios.
- MFS managed firewall
Discuss daily management, alerts and response responsibilities.
- Enterprise endpoint security
Explore protection management for employee computers.
- Business data backup
Include recovery from data incidents in the discussion.
Prepare for an enquiry
- Company size, office locations and main system types.
- Existing security tools and management responsibilities.
- Main concerns, affected areas and target improvement timeframe.
For an initial enquiry, describe the issue and equipment only. Do not submit passwords or verification codes. The team will arrange a secure channel for sensitive documents and incident records.
Enquire about business cybersecurityCybersecurity and AI useExplore security planning, responsibilities and acceptance considerations
Cybersecurity · Safe AI use
Business cybersecurity and managed protection: security planning priorities
「Cybersecurity solutions」 includes the following security priorities; measures, tests and deliverables are specified in the proposal.
- Assets and defencesIdentify systems, endpoints and networks to protect, checking applicable products, modules and policies for each scenario.
- Data and monitoringClarify log, intelligence and alert sources, exchanged data and recipients, defining monitoring and handling activities covered by the service.
- Response and responsibilitiesDiscuss incident classification, policy changes, recovery and business/support responsibilities, documenting owners and procedures for each task.
AI considerationsInventory AI assistant or agent data, service accounts and tool permissions separately. Network or endpoint protection does not cover every prompt-injection or agent-action risk.
Planning and acceptance recordsAsset and control lists, policy and alert-test records, incident procedures and service responsibilities.
You may also want to know
Where can an SME with a limited budget start?
List frequently used systems, user numbers, existing protections and previous abnormalities. Discuss priorities for patching, account permissions, backup recovery and staff guidance, together with incident contacts and responsibilities.
What should staff do first if they suspect an intrusion?
Notify the designated contact under the company's incident procedure and record the time and symptoms. Authorised personnel should decide on isolation, shutdown or evidence collection.
