How to secure RDP connections from ransomware

Microsoft Remote Desktop Protocol (RDP), the interface that allows users to connect to a remote machine, has been one of the primary vectors for ransomware attacks since the onset of the remote work era. Although many organizations are rapidly returning to the workplace, RDP is still widely embraced as part of the hybrid work model, leaving organizations at risk of RDP-related ransomware attacks. While RDP is generally regarded as secure for use in organizational networks, its vulnerability to ransomware often occurs due to faulty implementation.

In the haste of upholding user productivity by opening access for remote employees and providing remote system support, admins sometimes missed following proper security protocol when implementing RDP. More RDP ports were left exposed on the internet than ever before. Hackers exploited these exposed RDP ports with credential-based attacks such as brute-force to hijack the organizational systems, make them insecure, and install ransomware. Organizations were demanded large sums of money in return for access to their systems and data.

Measures to protect RDP from ransomware

The following measures are recommended to prevent RDP-based ransomware attacks:

• Multi-factor authentication: Implementing multiple layers of authentication during RDP client and RDP server logins helps thwart ransomware attacks, even if the RDP ports are exposed on the internet.
• Password policies: Most ransomware attacks using RDP ports depend on password-based attacks to gain access to the system. Stringent password policies encourage the creation of complex passwords that are tough to breach.
• Principle of least privilege: Provide RDP access privileges only for users that truly need it. This way, exposed credentials cannot be exploited to establish remote network access.
• VPN and firewall: To ensure that the RDP system is not exposed to the internet, allow RDP access only through a VPN. Limit RDP access to specific IP addresses or a range of IP addresses.
• Block user account and IP addresses after incorrect authentication: Set a minimum number of incorrect login attempts after which the user will be blocked from access to the system. The genuine user should gain access only after sufficiently proving their identity to the admin.
• Remote Desktop Gateway Server: This server role provides an encrypted RDP connection to the organizational servers. It also helps identify ransomware and other attacks by logging RDP sessions.
• Network Level Authentication: This native Windows feature requires the user attempting to establish an RDP connection to authenticate themselves before gaining access to the RDP server.

An effective solution to avert ransomware vulnerability

ManageEngine ADSelfService Plus simplifies the process of protecting RDP from ransomware. The endpoint security solution offers MFA for RDP and VPN, as well as advanced password policies, helping to create a strong RDP security policy that averts issues such as brute-force attacks. Some highlights of the solution include:

• Choice of more than 20 authentication methods, including biometrics, YubiKey, and Google Authenticator for MFA during RDP connection.
• Automatically alter authentication policies for outgoing remote desktop connections from a user's machine based on access data like IP address and geolocation.
• Fine-tune RDP security by enabling MFA for either outgoing RDP sessions from a user machine or for all incoming RDP connections to a remote machine.
• Support for over five authentication methods for MFA during VPN logins.
• Requirements like banning dictionary words, patterns, and palindromes, as well as the repetition of strings from old passwords and usernames as part of the advanced password policy enforcer.

Features of ADSelfService Plus

• Self-service password reset and account unlock
• Multi-factor authentication
• Enterprise SSO
• Password synchronization
• Conditional access policies
• Password policy enforcer
• Password expiration notification
• Directory self-service
• Mail group subscription
• Employee search and organizational chart