{"id":45533,"date":"2020-04-03T12:00:00","date_gmt":"2020-04-03T18:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=45533"},"modified":"2023-03-08T13:22:43","modified_gmt":"2023-03-08T18:22:43","slug":"mfa-rdp-access","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","title":{"rendered":"Adding MFA to RDP Access"},"content":{"rendered":"\n
As organizations hurry to move their employees to a fully remote work model, many IT departments are relying on the Windows Remote Desktop Protocol (RDP) to enable access to remote and\/or virtual systems and servers. Although effective for remote resource access, RDP is incredibly vulnerable to attack if left exposed to the internet. IT admins need to leverage VPNs and enforce multi-factor authentication (MFA)<\/a> on both their VPNs and RDP ports to prevent unauthorized RDP access.<\/p>\n\n\n\n Unlike other network connectivity ports that are used for hosting websites or similar purposes, RDP ports provide access to an entire system. But just as they make on-premises systems more accessible for end users, internet-exposed RDP ports let virtually anyone try to authenticate to them \u2014 most often, bad actors looking to worm into your network. In fact, many recent cybersecurity breaches<\/a> were due to unprotected RDP ports.<\/p>\n\n\n\n In a recent study, Shodan<\/a> found that, since the beginning of 2020, RDP exposure rates to the internet have increased significantly, going up nearly 30% in February alone. The uptick both makes a lot of sense and no sense at all. Current events have made a fully remote workforce a necessity, so it tracks that overall RDP usage has increased in response. What doesn\u2019t make sense, however, is that organizations are still exposing their RDP ports to the internet, despite the obvious risks. <\/p>\n\n\n\n It\u2019s a widely known best practice among IT professionals that all RDP ports should be protected by a VPN (virtual private network) to limit who can authenticate to RDP endpoints. Organizations can also implement MFA<\/a> to bolster their security even further.<\/p>\n\n\n\n A VPN is an encrypted tunnel between remote systems and network resources, and it can also be used to create private internet connections over public networks. When used for remote resource access, a VPN\u2019s encryption blocks most external attempts to track or change internet traffic, meaning a more secure experience.<\/p>\n\n\n\n By implementing a VPN on RDP ports, IT admins can ensure that access to the resources tied in to each port is not freely given: Anyone who wishes to access the RDP-gated resource will need to authenticate with the right set of credentials. <\/p>\n\n\n\n Unfortunately, this means that VPNs can possibly be cracked through brute-force or credential-stuffing attacks that are usually carried out by bots. Additionally, if a VPN has a single shared credential, then if one end user exposes the identity through phishing or other means, the VPN is compromised for everyone. <\/p>\n\n\n\n IT organizations can implement RADIUS<\/a> authentication on their VPN endpoints to require unique credentials for access. RADIUS is significantly more secure than using a shared set of credentials, but if a user\u2019s credentials are compromised, then IT organizations need an additional safeguard to protect their VPNs.<\/p>\n\n\n\n That\u2019s where MFA comes in. Requiring additional authentication factors at VPN and RDP system login creates a more secure login process. MFA has shown to be virtually 100% effective<\/a> at blocking brute-force bot attempts and almost as effective for targeted attacks, depending on the type of MFA<\/a> utilized.<\/p>\n\n\n\n By pairing both a VPN and MFA, IT admins ensure that their end users have access to the resources they need from wherever they find themselves while maintaining the utmost possible security as well. The challenge for IT admins then becomes how to implement VPNs and MFA across their user base.<\/p>\n\n\n\n\nThe Problems of Exposed RDP<\/h2>\n\n\n\n
Why VPN and MFA?<\/h2>\n\n\n\n