The rise of remote work and digital nomadism in today’s online business landscape makes securing Remote Desktop Protocol (RDP) connections paramount. With RDP being a popular choice for remote access, understanding its security is crucial. Is RDP inherently secure? If not, what measures can be taken to protect sensitive data when using it?

What Is RDP?

Remote Desktop Protocol (RDP) is a Microsoft proprietary protocol enabling users to remotely connect to another computer via a network. It provides a graphical interface that allows users to access the remote machine’s desktop and applications as if they were physically there.

Is RDP Secure?

While widely used, RDP presents security challenges that require careful attention to prevent unauthorized access and data breaches.

Encryption in RDP

RDP uses 128-bit encryption to safeguard data transmission. However, the default encryption settings might not suffice for all environments, making configuration for enhanced security crucial.

Common RDP Vulnerabilities

Several vulnerabilities can compromise RDP’s security:

• Weak Passwords: Simple or default passwords offer easy access to attackers.
• Open RDP Ports: Exposing RDP ports to the internet increases the risk of brute force and denial-of-service attacks.
• Lack of Multi-Factor Authentication: The absence of 2FA makes unauthorized access more likely if credentials are stolen.
• Unpatched Systems: Failing to apply security updates leaves systems open to known vulnerabilities.

How to Secure RDP?

Implement these best practices to bolster RDP security:

Enable Network Level Authentication (NLA)

NLA adds a security layer by requiring users to authenticate before a full RDP session begins. To enable NLA:

1. Open the System Properties dialog box.
2. Click the Remote tab.
3. Under Remote Desktop, select "Allow connections only from computers running Remote Desktop with Network Level Authentication."


Implement Two-Factor Authentication (2FA)

2FA provides an additional layer of security by requiring a second verification method. Solutions such as Duo Security can integrate 2FA with RDP.

Restrict RDP Access

Limit access to specific users and groups, and disable RDP for those who don’t require it. To restrict access:

1. Open Local Group Policy Editor.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections.
3. Configure "Allow users to connect remotely by using Remote Desktop Services."


Apply Windows Updates

Keep Windows systems up-to-date with the latest security patches. Configure automatic updates in Windows Update settings.

Use VPNs for Secure Remote Connections

A VPN provides an encrypted tunnel for RDP sessions, enhancing security. Ensure proper VPN configuration and enforce VPN usage for all users.

Whitelist IP Addresses

Restrict RDP access to trusted IP addresses via a firewall or router. This reduces the risk of unauthorized access.

To configure a Windows Firewall rule:
1. Open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules > New Rule.
3. Select Custom, then Next.
4. Specify the IP addresses to allow, then finish the rule setup.


Additional RDP Security Measures

Further enhance RDP security with these measures:

Audit Logs

Enable audit logs to track RDP access and activities, helping to detect and respond to suspicious behavior.

1. Open Local Group Policy Editor.
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration.
3. Configure auditing for logon events.


Account Lockout Policies

Implement account lockout policies to prevent brute force attacks by locking accounts after failed login attempts.

1. Open Local Group Policy Editor.
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.
3. Set the desired values for lockout threshold and duration.


Session Timeout Settings

Set session timeouts to automatically log off inactive sessions, reducing the risk of unauthorized access if a session is left unattended.

1. Open Local Group Policy Editor.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits.
3. Configure session time limits.


Disable Clipboard Redirection

Disable clipboard redirection to prevent data leakage between local and remote systems. This can be configured through Group Policy:

1. Open Local Group Policy Editor.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.
3. Disable "Do not allow clipboard redirection."


Use DP Gateways

Utilizing an RDP Gateway is highly recommended for securely restricting access to Remote Desktop ports while enabling remote connections through a single gateway server. With an RD Gateway server, configure all Remote Desktop services on desktops and workstations to allow access solely from the RD Gateway. The RD Gateway server listens for Remote Desktop requests over HTTPS (port 443) and connects the client to the Remote Desktop service on the target machine.

• Utilize Campus RDP Gateway Service: This is the optimal choice for RDP access to systems classified as UC P2 and lower, including DUO integration. This RDP Gateway Service is provided by the Windows Team. Documentation is available here.
• Compliance with Remote Access Services Requirement: The RDP Gateway Service fulfills the new Remote Access Services requirement of the draft MSSND update (requirement 8), which requires an approved service (e.g., RDP gateway, dedicated gateway, or bSecure VPN) for accessing the UC Berkeley network from the public Internet.
• Dedicated Gateway Service (Managed): This is required for RDP access to systems categorized as UC P4 or higher and must be configured for DUO. Some campus units use a Berkeley IT managed VPS as an RD Gateway, supporting an estimated 30-100 concurrent users. High Availability (HA) at the virtual layer ensures fault tolerance and reliable access, with the option for network load balancing for more sophisticated implementations.
• Dedicated Gateway Service (Unmanaged): This involves installing and configuring the RD Gateway on department-run hardware. Numerous online documents are available for configuring this component in Windows 2016/2019. Official documentation can be found here.
• Certificates: While a self-signed certificate is acceptable for testing, a Calnet-issued trusted Comodo certificate is recommended for production. A CalnetPKI certificate can also work if all clients trust the UCB root, but a Comodo certificate is generally better accepted to avoid certificate warnings for end users.
• Client Configuration: Configuring your client to use your RD Gateway is straightforward. The official documentation for the MS Client is available here. Essentially, you only need to make a simple change on the advanced tab of your RDP client.

An RDP Gateway ensures a higher level of security for Remote Desktop connections, protects sensitive data, and maintains compliance with security requirements.

Connect to RDP Server with SSH

Using SSH tunneling for RDP adds an extra layer of security by encrypting the RDP traffic. If an RD Gateway is not practical, tunneling Remote Desktop sessions through IPSec or SSH enhances security with additional authentication and encryption. IPSec is integrated into all Windows OS since Windows 2000, with usability and management enhanced in Windows 10 (see: Microsoft Technet). An SSH server allows you to use SSH tunneling for Remote Desktop connections.

---

---

This article incorporates information from various online sources. We acknowledge and appreciate the work of all original authors, publishers, and websites. While every effort has been made to appropriately credit source material, any unintentional omission does not constitute a copyright infringement. All trademarks, logos, and images mentioned are the property of their respective owners. If you believe that any content used in this article infringes upon your copyright, please contact us immediately for review and prompt action.

This article is for informational and educational purposes and does not infringe on the rights of copyright owners. Unintentional use of copyrighted material without proper credit or in violation of copyright laws will be rectified promptly upon notification. Republishing, redistribution, or reproduction of part or all of the contents in any form is prohibited without express written permission from the author and website owner. Contact us for permissions or further inquiries.