{"id":43799,"date":"2020-01-20T09:00:00","date_gmt":"2020-01-20T16:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=43799"},"modified":"2024-11-14T19:41:39","modified_gmt":"2024-11-15T00:41:39","slug":"prevent-rdp-brute-force","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force","title":{"rendered":"3 Tips to Prevent Brute-Force Attacks on RDP Ports"},"content":{"rendered":"\n

It\u2019s widely known that leaving Windows\u00ae<\/sup> Remote Desktop Protocol (RDP) ports open to the internet is a major risk to cybersecurity in the enterprise. If your organization needs to do so for any reason, however, there are steps you can take to protect yourself. Although we would never condone this practice, we\u2019ve come up with three tips to help prevent brute-force attacks on open RDP ports and Windows virtual machines (VMs).<\/p>\n\n\n\n

Why Open RDP Ports are a Security Issue<\/h2>\n\n\n\n

RDP is a proprietary Microsoft\u00ae<\/sup> protocol that allows remote access to a system\/server over the internet. Unlike other network connectivity ports that are used for hosting websites or similar purposes, RDP ports provide access to an entire system. If compromised in any way, an exposed RDP port can cripple an organization, especially if the account compromised is the virtual machine\u2019s admin.<\/p>\n\n\n\n

That\u2019s why, in general, IT organizations hosting VMs via RDP centralize their machines in a virtual private cloud (VPC). These VPCs are guarded by virtual private network (VPN) connections \u2014 authentication \u201ctunnels\u201d that remotely connect authorized users to the VPC.<\/p>\n\n\n\n

Some organizations, however, leave their RDP ports open to the internet. A few of these organizations do so unwittingly, unaware of the ticking time bomb they\u2019ve accidentally created. Others leave ports open willingly. An organization that does so is knowingly operating on borrowed time from a security standpoint. Regardless of intent, RDP ports are still being left open to the internet, and subsequently open to attack.<\/p>\n\n\n\n

Unguarded VMs on open RDP ports are one of the top points of entry for brute-force attacks. For instance, a botnet, dubbed Goldbrute<\/a>, recently wreaked havoc on more than a million IP addresses, stuffing credentials into these open VMs and successfully bypassing their simple login windows. Once inside the VM, Goldbrute uses the machine to seek out additional hosts, spreading across more random IP addresses and cataloguing successful credential combinations to resell on the dark web.<\/p>\n\n\n\n

In a related-yet-separate instance, a Spanish MSP, Everis<\/a>, and one of its clients, Spain\u2019s largest radio network, were recently hit by ransomware. The source of the breach? Thousands of exploitable RDP servers, left open to the whims of the internet. Although some are attributing the attack to a now-patched vulnerability called BlueKeep<\/a>, the thousands of exposed RDP servers were critical to the breach.<\/p>\n\n\n\n

3 Tips to Prevent Brute-Force Attacks on RDP Ports<\/h2>\n\n\n\n

Organizations need to safeguard their RDP ports from brute-force attack, so we\u2019ve compiled three straightforward tips to help prevent these types of attacks.<\/p>\n\n\n\n

1. Stronger Passwords<\/h3>\n\n\n\n

It should already be an organization-wide security practice, but strong passwords are a must for any business. Goldbrute used weak\/reused passwords to crack unprotected RDP servers with relative ease. So, IT organizations need to enforce password length, complexity, and even potentially rotation policies to ensure their VMs and other critical enterprise systems are ready for a brute-force attack.<\/p>\n\n\n\n

Of course, some end users struggle to remember long, complex passwords, resorting to the even worse security \u201cpractice\u201d of writing their passwords on a sticky note affixed to their monitor. As such, sysadmins should invest in some sort of password manager or even centralize their passwords<\/a> to assist end users while maintaining security.<\/p>\n\n\n\n

2. VPN<\/h3>\n\n\n\n

As we mentioned earlier, a VPN is a common way of gating RDP port access. By setting up a VPN, organizations can add an additional layer of authentication to keep the bad guys out.<\/p>\n\n\n\n

Of course, VPNs have their own potential drawbacks. Some organizations find that setting up a VPN is too technical for their already swamped IT teams. Additionally, while a VPN will help to protect a VM, if the VPN is secured with a weak, reused password, then it too can be brute forced by bot attacks.<\/p>\n\n\n\n

3. MFA<\/h3>\n\n\n\n

Multi-factor authentication (MFA) is arguably the best method for securing authentication. MFA adds an extra layer of security to the standard username\/password login process. Many forms of MFA use a randomly generated, six-digit code to reassure a user\u2019s identity.<\/p>\n\n\n\n

In their study of MFA, Google\u2019s Security Blog<\/a> found that device-based MFA is 100% effective at preventing account takeovers due to bot attacks. Obviously, having some form of device-based MFA to safeguard RDP-connected servers is crucial. Armed with the proper solution, IT organizations can enforce MFA on both their Windows VM and<\/em> VPNs, almost completely barring brute-force attacks against them.<\/p>\n\n\n\n

How to Enforce These Practices<\/h2>\n\n\n\n

If your organization needs to safeguard exposed RDP ports and enforce these tips, there\u2019s a solution that can help. A cloud directory service<\/a> unifies a user\u2019s identity with one strong password, which applies to virtually all their resources, including Windows VMs and VPNs, and backs them with multi-factor authentication.<\/p>\n\n\n\n

Want to learn more about this cloud directory service? Contact us<\/a> or schedule a free demo<\/a>.
<\/p>\n","protected":false},"excerpt":{"rendered":"

If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.<\/p>\n","protected":false},"author":70,"featured_media":43803,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[23],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3016],"coauthors":[2515],"acf":[],"yoast_head":"\n3 Tips to Prevent Brute-Force Attacks on RDP Ports - JumpCloud<\/title>\n<meta name=\"description\" content=\"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"3 Tips to Prevent Brute-Force Attacks on RDP Ports\" \/>\n<meta property=\"og:description\" content=\"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-20T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-15T00:41:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"780\" \/>\n\t<meta property=\"og:image:height\" content=\"521\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Zach DeMeyer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zach DeMeyer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#article\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\"},\"author\":{\"name\":\"Zach DeMeyer\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\"},\"headline\":\"3 Tips to Prevent Brute-Force Attacks on RDP Ports\",\"datePublished\":\"2020-01-20T16:00:00+00:00\",\"dateModified\":\"2024-11-15T00:41:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\"},\"wordCount\":809,\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg\",\"articleSection\":[\"Best Practices\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\",\"url\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\",\"name\":\"3 Tips to Prevent Brute-Force Attacks on RDP Ports - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg\",\"datePublished\":\"2020-01-20T16:00:00+00:00\",\"dateModified\":\"2024-11-15T00:41:39+00:00\",\"description\":\"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg\",\"width\":780,\"height\":521},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"3 Tips to Prevent Brute-Force Attacks on RDP Ports\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\",\"name\":\"Zach DeMeyer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"caption\":\"Zach DeMeyer\"},\"description\":\"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.\",\"sameAs\":[\"http:\/\/www.jumpcloud.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"3 Tips to Prevent Brute-Force Attacks on RDP Ports - JumpCloud","description":"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force","og_locale":"en_US","og_type":"article","og_title":"3 Tips to Prevent Brute-Force Attacks on RDP Ports","og_description":"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.","og_url":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force","og_site_name":"JumpCloud","article_published_time":"2020-01-20T16:00:00+00:00","article_modified_time":"2024-11-15T00:41:39+00:00","og_image":[{"width":780,"height":521,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg","type":"image\/jpeg"}],"author":"Zach DeMeyer","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Zach DeMeyer","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#article","isPartOf":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force"},"author":{"name":"Zach DeMeyer","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d"},"headline":"3 Tips to Prevent Brute-Force Attacks on RDP Ports","datePublished":"2020-01-20T16:00:00+00:00","dateModified":"2024-11-15T00:41:39+00:00","mainEntityOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force"},"wordCount":809,"publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg","articleSection":["Best Practices"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force","url":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force","name":"3 Tips to Prevent Brute-Force Attacks on RDP Ports - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg","datePublished":"2020-01-20T16:00:00+00:00","dateModified":"2024-11-15T00:41:39+00:00","description":"If you have to expose your Windows RDP ports to the internet, follow these 3 tips to safeguard them from brute-force attacks.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/01\/3-tips-brute-force.jpg","width":780,"height":521},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/blog\/prevent-rdp-brute-force#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"3 Tips to Prevent Brute-Force Attacks on RDP Ports"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d","name":"Zach DeMeyer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219","url":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","caption":"Zach DeMeyer"},"description":"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.","sameAs":["http:\/\/www.jumpcloud.com"]}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/43799"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/70"}],"replies":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/comments?post=43799"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/43799\/revisions"}],"predecessor-version":[{"id":117621,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/43799\/revisions\/117621"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media\/43803"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=43799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/categories?post=43799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/tags?post=43799"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/collection?post=43799"},{"taxonomy":"platform","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/platform?post=43799"},{"taxonomy":"funnel_stage","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/funnel_stage?post=43799"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=43799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}