{"id":45533,"date":"2020-04-03T12:00:00","date_gmt":"2020-04-03T18:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=45533"},"modified":"2023-03-08T13:22:43","modified_gmt":"2023-03-08T18:22:43","slug":"mfa-rdp-access","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","title":{"rendered":"Adding MFA to RDP Access"},"content":{"rendered":"\n

As organizations hurry to move their employees to a fully remote work model, many IT departments are relying on the Windows Remote Desktop Protocol (RDP) to enable access to remote and\/or virtual systems and servers. Although effective for remote resource access, RDP is incredibly vulnerable to attack if left exposed to the internet. IT admins need to leverage VPNs and enforce multi-factor authentication (MFA)<\/a> on both their VPNs and RDP ports to prevent unauthorized RDP access.<\/p>\n\n\n\n

The Problems of Exposed RDP<\/h2>\n\n\n\n

Unlike other network connectivity ports that are used for hosting websites or similar purposes, RDP ports provide access to an entire system. But just as they make on-premises systems more accessible for end users, internet-exposed RDP ports let virtually anyone try to authenticate to them \u2014 most often, bad actors looking to worm into your network. In fact, many recent cybersecurity breaches<\/a> were due to unprotected RDP ports.<\/p>\n\n\n\n

In a recent study, Shodan<\/a> found that, since the beginning of 2020, RDP exposure rates to the internet have increased significantly, going up nearly 30% in February alone. The uptick both makes a lot of sense and no sense at all. Current events have made a fully remote workforce a necessity, so it tracks that overall RDP usage has increased in response. What doesn\u2019t make sense, however, is that organizations are still exposing their RDP ports to the internet, despite the obvious risks. <\/p>\n\n\n\n

It\u2019s a widely known best practice among IT professionals that all RDP ports should be protected by a VPN (virtual private network) to limit who can authenticate to RDP endpoints. Organizations can also implement MFA<\/a> to bolster their security even further.<\/p>\n\n\n\n

Why VPN and MFA?<\/h2>\n\n\n\n

A VPN is an encrypted tunnel between remote systems and network resources, and it can also be used to create private internet connections over public networks. When used for remote resource access, a VPN\u2019s encryption blocks most external attempts to track or change internet traffic, meaning a more secure experience.<\/p>\n\n\n\n

By implementing a VPN on RDP ports, IT admins can ensure that access to the resources tied in to each port is not freely given: Anyone who wishes to access the RDP-gated resource will need to authenticate with the right set of credentials. <\/p>\n\n\n\n

Unfortunately, this means that VPNs can possibly be cracked through brute-force or credential-stuffing attacks that are usually carried out by bots. Additionally, if a VPN has a single shared credential, then if one end user exposes the identity through phishing or other means, the VPN is compromised for everyone. <\/p>\n\n\n\n

IT organizations can implement RADIUS<\/a> authentication on their VPN endpoints to require unique credentials for access. RADIUS is significantly more secure than using a shared set of credentials, but if a user\u2019s credentials are compromised, then IT organizations need an additional safeguard to protect their VPNs.<\/p>\n\n\n\n

That\u2019s where MFA comes in. Requiring additional authentication factors at VPN and RDP system login creates a more secure login process. MFA has shown to be virtually 100% effective<\/a> at blocking brute-force bot attempts and almost as effective for targeted attacks, depending on the type of MFA<\/a> utilized.<\/p>\n\n\n\n

By pairing both a VPN and MFA, IT admins ensure that their end users have access to the resources they need from wherever they find themselves while maintaining the utmost possible security as well. The challenge for IT admins then becomes how to implement VPNs and MFA across their user base.<\/p>\n\n\n\n\n

\n
\n \"JumpCloud\"\n <\/div>\n
\n

\n Enable Secure Hybrid Work Anywhere, Anytime <\/p>\n

\n Identity, access, and device management from a single cloud-based console <\/p>\n <\/div>\n

\n Learn More<\/a>\n <\/div>\n<\/div>\n\n\n\n\n

Securing RDP Access with a Cloud Directory Service<\/h2>\n\n\n\n

With a cloud directory service like JumpCloud Open Directory<\/a>, IT organizations can integrate their VPNs<\/a> with a core directory, meaning end users leverage a unique identity for all of their VPN connections. That identity also propagates out to their devices and other IT resources, also known as True Single Sign-On\u2122<\/a>. Because it\u2019s cloud based, admins can use JumpCloud to manage access to endpoints and other resources from wherever they find themselves \u2014 with all updates pushing to end users remotely as well.<\/p>\n\n\n\n

Admins can then lock down access to Windows, Mac, and Linux virtual machines connected to RDP ports, as well as the VPNs used to access them through JumpCloud\u2019s MFA offering. JumpCloud MFA applies to devices, applications, and infrastructure as well.<\/p>\n\n\n\n

Learn More<\/h2>\n\n\n\n

If you need to enable secure remote access for your end users as they work from home, learn more by checking out our Remote Work Solutions page<\/a> for guides and other resources on how to shift your organization to a fully remote work model. You can also learn more about using MFA with RADIUS in How to Maintain Network Security For Remote Workers with RADIUS MFA<\/em><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.<\/p>\n","protected":false},"author":70,"featured_media":45534,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2781,2337],"tags":[],"collection":[2775],"platform":[],"funnel_stage":[3016],"coauthors":[2515],"acf":[],"yoast_head":"\nAdding MFA to RDP Access - JumpCloud<\/title>\n<meta name=\"description\" content=\"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Adding MFA to RDP Access\" \/>\n<meta property=\"og:description\" content=\"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-03T18:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-08T18:22:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"780\" \/>\n\t<meta property=\"og:image:height\" content=\"439\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Zach DeMeyer\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zach DeMeyer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#article\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\"},\"author\":{\"name\":\"Zach DeMeyer\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\"},\"headline\":\"Adding MFA to RDP Access\",\"datePublished\":\"2020-04-03T18:00:00+00:00\",\"dateModified\":\"2023-03-08T18:22:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\"},\"wordCount\":780,\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg\",\"articleSection\":[\"How-To\",\"Remote Work\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\",\"url\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\",\"name\":\"Adding MFA to RDP Access - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg\",\"datePublished\":\"2020-04-03T18:00:00+00:00\",\"dateModified\":\"2023-03-08T18:22:43+00:00\",\"description\":\"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg\",\"width\":780,\"height\":439},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Adding MFA to RDP Access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d\",\"name\":\"Zach DeMeyer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g\",\"caption\":\"Zach DeMeyer\"},\"description\":\"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.\",\"sameAs\":[\"http:\/\/www.jumpcloud.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Adding MFA to RDP Access - JumpCloud","description":"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","og_locale":"en_US","og_type":"article","og_title":"Adding MFA to RDP Access","og_description":"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.","og_url":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","og_site_name":"JumpCloud","article_published_time":"2020-04-03T18:00:00+00:00","article_modified_time":"2023-03-08T18:22:43+00:00","og_image":[{"width":780,"height":439,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg","type":"image\/jpeg"}],"author":"Zach DeMeyer","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Zach DeMeyer","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#article","isPartOf":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access"},"author":{"name":"Zach DeMeyer","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d"},"headline":"Adding MFA to RDP Access","datePublished":"2020-04-03T18:00:00+00:00","dateModified":"2023-03-08T18:22:43+00:00","mainEntityOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access"},"wordCount":780,"publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg","articleSection":["How-To","Remote Work"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","url":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access","name":"Adding MFA to RDP Access - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg","datePublished":"2020-04-03T18:00:00+00:00","dateModified":"2023-03-08T18:22:43+00:00","description":"Although effective for remote access, RDP ports are vulnerable to attack when exposed to the internet. Learn how to protect remote workers here.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/blog\/mfa-rdp-access"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2020\/04\/mfa-rdp-access.jpg","width":780,"height":439},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/blog\/mfa-rdp-access#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Adding MFA to RDP Access"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/5b2c563fb7404910e9be96e7d4e7828d","name":"Zach DeMeyer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/person\/image\/d1d6602d927eb5a16b1dfd4ba6b4c219","url":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2145e4e676784129043e5eec7c4e41e6?s=96&d=mm&r=g","caption":"Zach DeMeyer"},"description":"Zach is a Product Marketing Specialist at JumpCloud with a degree in Mechanical Engineering from the Colorado School of Mines. He loves being on the cutting edge of new technology, and when he's not working, he enjoys all things outdoors, music, and soccer.","sameAs":["http:\/\/www.jumpcloud.com"]}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/45533"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/70"}],"replies":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/comments?post=45533"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/45533\/revisions"}],"predecessor-version":[{"id":77385,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/posts\/45533\/revisions\/77385"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media\/45534"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=45533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/categories?post=45533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/tags?post=45533"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/collection?post=45533"},{"taxonomy":"platform","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/platform?post=45533"},{"taxonomy":"funnel_stage","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/funnel_stage?post=45533"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=45533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}