Remote Desktop Protocol (RDP) is a proprietary protocol created by Microsoft. It allows a system user to connect to a remote system with a graphical user interface.
Even though the client-side is built into the Microsoft operating system by default, it can be installed on non-Microsoft operating systems, such as those from Apple, various flavors of Linux, and even mobile OSes like Android.
On the server side of RDP, it is installed on a Microsoft operating system and receives requests from the client agents to display some graphical form of a published application, or remote access to the system itself. By default, a system will listen on port 3389 for requests from clients to connect via the RDP.
RDP uses port 3389. Opening up this port on the firewall means that as attackers scan for open ports, your vulnerability can easily be found. Once found, hackers can instantly launch a brute force attack against your server resulting in 1000s of authentication attempts with random user names and/or dictionary passwords to see if any of them matches and passes the authentication. If a match is found, the attacker is in.
Not using proper encryption for the end-to-end connection is another issue. This means that your connection is prone to man-in-the-middle attacks.
Some good practices for securing RDP practices are:
- Use Strong Passwords: Passwords are your first line of defense
- Don’t Save Login Credentials in Your RDP Files: Saving them can be a potential security exposure because it bypasses the remote login.
- Limit Administrators Who Don’t Need Remote Desktop: If not all your administrators need access to Remote Desktop, then you should consider removing the Administrator account from RDP access.
- Use Lockout Policies to Strengthen Password Protection: Locking out the system for a specified period of time after a number of incorrect guesses.
- Take Advantage of Network Level Authentication: It provides a level of authentication before you establish an RDP session and the login screen appears.
Smalley, F. Securing Remote Desktop (RDP) for System Administrators. Berkeley. Recovery date: February 2nd 2018. Recovered from: https://security.berkeley.edu/resources/best-practices-how-articles/system-application-security/securing-remote-desktop-rdp-system
Pascucci, M. (2012) Remote Desktop Protocol security: How to secure RDP network endpoints. Techtarget. Recovery date: February 2nd 2018. Recovered from: http://searchsecurity.techtarget.com/tip/Remote-Desktop-Protocol-security-How-to-secure-RDP-network-endpoints
Otey, M. (2017) Guest Blog: Best Practices for Securing Remote Desktop Connections. Devolutions. Recovery date: February 2nd 2018. Recovered from: https://blog.devolutions.net/2017/5/best-practices-for-securing-remote-desktop-connections
Nahal, R. (2016). Why Direct RDP for Remote Users is a Bad, Bad Thing. Tektegrity, Recovery date: February 2nd 2018. Recovered from: https://www.tektegrity.com/news-and-articles/2016/09/07/why-direct-rdp-for-remote-users-is-a-bad-bad-thing/