First, a word on who we are: we are Beijing Siwenlide, based in Shunyi, and we have spent 14 years providing enterprise IT Operations Outsourcing and network packages, with our own zero trust remote access product, sTrust. This article answers a very specific question: if a company in Beijing wants its traveling, work-from-home, and branch-office employees to securely access the head office’s ERP, OA, and file servers, how should it be done, who should do it, and who manages it afterwards.
Search for “zero trust” and almost everything that comes up is product pages and vendor rankings, all talking about feature lists. But for a company of a few dozen people, the hard part is not choosing a product — it is these questions: which systems should be opened up, to whom, who shuts off access when an employee leaves, who opens it when someone new joins, and who to call when something goes wrong. That is the part this article covers.
Four common ways employees access company systems from outside
| Approach | How it works | Risk and who it suits |
|---|---|---|
| 1. Port forwarding to the public internet | Expose the ERP and remote desktop ports directly, and let employees connect through public addresses | Not recommended for any company. The system login page sits directly on the internet, and scanners will keep trying passwords |
| 2. Remote control software | Employees remotely control an office computer from outside | Acceptable as a stopgap. The office computer must stay on at all times, accounts are scattered among individuals, and they are hard to reclaim after an employee leaves |
| 3. Traditional VPN | Employees dial in and join the corporate intranet | Far safer than port forwarding. But once connected you are on the intranet, permissions are often excessive, and a single compromised laptop can scan the entire network |
| 4. Zero trust remote access | Verify identity and device first, then grant access only to the specific system authorized, with business systems invisible from the public internet | Companies with multiple business systems, frequent staff turnover, or clients and auditors starting to ask about information security |
Among the companies we have taken over, the first approach is the most common and also the most dangerous. Many owners do not know their ERP is exposed to the internet until the day they find the system locked or the data encrypted.
Three types of providers you can turn to
| Type | Characteristics | Who it suits |
|---|---|---|
| 1. Direct contract with a security vendor | Big-brand zero trust products with a full feature set and MLPS and auditing capabilities. Usually charged per account or per gateway, and deployment and authorization rules must be configured by your own team | Mid-size and large enterprises with a dedicated IT or security team |
| 2. SaaS subscription | Software activation with no hardware purchase, subscribed per user. Fast to activate, but someone still has to decide and configure which systems are opened up and to whom | Companies with someone who can manage accounts and rules in the admin console |
| 3. Working with an IT Operations Services provider (this is what we do) | Treating remote access as part of network operations: taking inventory of the systems to be opened, defining authorization rules, creating accounts, shutting down public port forwarding, and then keeping onboarding and offboarding in step with HR changes | Small and mid-size businesses without dedicated IT staff, that do not want to configure the rules themselves, and that want someone to manage the whole process end to end |
The five things that really need to be done during implementation
- Take inventory of which systems are exposed to the public internet: ERP, OA, file servers, remote desktop, surveillance recorders — check each one for public port forwarding. Many companies find more than they expected.
- Define authorization rules: who can access which system. Finance gets only the finance system, sales gets only the CRM, an outsourced contractor gets only the one server they are responsible for — authorize per person and per system, rather than letting anyone who connects use everything.
- Create accounts and verification methods: one account per person, plus a second factor such as an SMS code. Shared accounts are the root cause of permissions that cannot be revoked after an employee leaves.
- Shut down the old public port forwarding: once the new channel is live and employees are using it, close every port that was previously exposed. This step is often forgotten, which amounts to locking the front door while leaving the back door open.
- Tie it into HR processes: who creates the account when someone joins, who disables it on the day they leave, and how to re-bind a new phone or computer. If no one owns this, even zero trust will gradually drift back to “everyone can get in”.
Four typical problems we have seen
- Remote desktop exposed directly on the public internet. We have seen this repeatedly in clients’ firewall logs: remote desktop ports exposed to the public internet are continuously hit with password attempts from addresses all over the world.
- Former employees’ accounts still work. The VPN accounts were all created years ago, and no one remembers who is using them or who has left.
- One account shared by everyone. When something goes wrong and you check the logs, all you can see is that “that account” logged in — not who it was.
- The new channel is live but the old ports are still open. You think you are secure because you deployed zero trust, then a scan shows the ERP’s forwarded port is still there.
Five things to ask before signing
- Do we need to buy hardware? Small and mid-size businesses should prioritize options that are activated in software and require no gateway purchase.
- Is the control plane located in China, and is the connection stable? Remote access is used every day, so a direct domestic connection and stable lines matter more than a long feature list.
- How granular can authorization be? Can it be granted per person and per system, rather than opening up an entire department?
- How are departures and device changes handled? Can an account be disabled with one click in the admin console, and does it take effect immediately?
- Are there access logs, and can they support MLPS compliance? Can you look up who accessed which system and when?
What we can do, and what we are not suited for
- In-house developed sTrust zero trust remote access: activated in software with no hardware to buy; the control plane is hosted in China and has completed ICP filing (China’s required website registration), with direct domestic connectivity. Business systems stay invisible to the public internet, authorization is granted per account and per system, every access is fully auditable, and it supports MLPS 2.0 compliance.
- End-to-end delivery, from inventory to close-out: we identify which systems are currently exposed to the public internet, define authorization rules, provision accounts, and once the new channel is stable, shut down the original public port mappings.
- Account management that follows HR changes: provisioned on onboarding, disabled the day someone leaves, re-bound when devices change — all through the same support request channel.
- Managed together with network operations: firewalls, multi-branch networking, backup, and remote access are all handled by the same team — no passing the buck with “the tunnel is theirs, the network is ours.”
- Thousands of employees, a dedicated security team, deep integration with existing identity systems — you are better off contracting directly with a large security vendor.
- Only one or two people occasionally working remotely — remote control software with a strong password is enough; there is no need for a full solution.
- Development and re-engineering of the business systems themselves — that belongs with your software vendor; we handle the access channel, authorization, and networking.
Frequently Asked Questions
Q: For a 40-person company, how much does remote access plus day-to-day IT operations cost per month?
A: Based on headcount you fall into our standard tier, from RMB 3,999/month, covering remote access, backup, network equipment, and unlimited support requests. For 50 to 100 people, the all-inclusive tier starts at RMB 6,999/month and includes zero trust remote access and connectivity between two sites.(Reference as of September 2026; not a binding quotation. What each tier includes is published on our official website.)
Q: What exactly is the difference between zero trust and a VPN?
A: With a VPN, once you connect you are on the internal network; with zero trust, you are verified first and then granted access only to the specific system your authorization allows, while business systems stay invisible to the public internet. For employees the experience is much the same; for the company the exposed surface is far smaller and revoking access when someone leaves is simple.
Q: We don’t have an IT team — can we still make this work?
A: Yes. We can configure and maintain the rules and accounts for you; employees just install one client and log in once.
Q: We already use a VPN. Should we switch?
A: Start with an inventory. If your VPN accounts are well managed and permissions are limited, you can leave things as they are for now. If accounts are messy, shared, not revoked when people leave, or port mappings are also left open, we recommend switching.
Not sure which of your company’s systems are exposed to the public internet?
Siwenlide has been delivering enterprise IT operations and network equipment packages for 14 years, and we build our own zero trust remote access product, sTrust. We can start with a free inventory of your internet-facing systems and ports and give you a written list. Call 400-686-2011.
Further reading:How to choose an enterprise zero trust remote access solution · How risky is exposing remote desktop directly to the public internet · How Beijing enterprises deploy multi-branch networking · What IT outsourcing costs a small or medium business per year
