Overview

Network security involves protecting the integrity, confidentiality, and availability of data as it travels across networks. For Hong Kong organisations, this includes compliance with local regulations and protection against region-specific threats.

Network Segmentation

Divide your network into smaller, isolated segments to limit the spread of attacks. Recommended segments include:

  • Corporate LAN: Employee workstations and internal resources
  • DMZ (Demilitarised Zone): Public-facing servers and services
  • Management Network: Network equipment and administration tools
  • Guest Network: Visitor and IoT device access

Firewall Configuration

Implement a layered firewall strategy:

  • Perimeter firewall (next-generation) for internet-facing traffic
  • Internal firewalls between network segments
  • Host-based firewalls on critical servers

VPN and Remote Access

Use enterprise-grade VPN solutions with strong encryption (AES-256) and enforce multi-factor authentication for all remote connections. Consider implementing Zero Trust Network Access (ZTNA) for modern remote work scenarios.

Intrusion Detection and Prevention

Deploy IDS/IPS systems at network boundaries and monitor traffic patterns for anomalies. Integrate with a SIEM solution for centralised log analysis and alerting.

Wireless Security

  • Use WPA3 encryption for all wireless networks
  • Implement enterprise authentication (802.1X) where possible
  • Disable WPS on all access points
  • Regularly audit wireless access points and remove unauthorised devices

Hong Kong operator checklist

  1. Confirm whether the systems, vendors, or practices described apply to your estate.
  2. Assign an owner and a review date — do not leave findings as unread newsletter content.
  3. Capture evidence (configs, tickets, screenshots) if you later enter a Trust Review.
  4. Brief leadership with a dated one-page note when residual risk remains high.

What “good” looks like

  • Controls are operated, not only documented
  • Privileged access uses phishing-resistant MFA where feasible
  • Detection and response paths are exercised at least annually
  • Third-party dependencies have an owner and an exit plan

Sources and further reading

Editorial note

This page is published by the Hong Kong Information Security Group (HKISG) for educational and early-warning purposes. It is not a substitute for legal advice, formal audit opinions, or national CERT coordination.

Frequently asked questions

Who should read this?

Security, IT, and risk owners in Hong Kong organisations who need practical context rather than marketing claims.

Does this change any public HKISG rating?

No. TrustScores are produced only through the published Trust Review / Awards process. Reading this page does not alter scores.

How often is this content reviewed?

HKISG dates publications and retains corrections under our editorial standards. Check the updated field in the page header when present.