devopsy.kinsta.cloud

Tag: RDP

  • No Excuses: Lock Down RDP

    No Excuses: Lock Down RDP

    We’ve been at the “everyone working remote” thing for months now, and still there are horror stories of people being attacked via Remote Desktop Protocol (RDP). Early on, it was understandable if not acceptable—but we’re not early on any more.

    During the rush of doing whatever it took to help people work from home, exposed RDP was just one of many stories we heard from systems operators, helpdesk and systems admins. Stories of people carrying desktops home, or thinking that tethering to their phone was a “good enough” internet solution predominated. But those issues are clearing up, and they’re specific to a company or a subset of employees. RDP seems to be more persistent.

    According to Shodan (article last updated end of March 2020), RDP use has spiked—and unprotected RDP use has spiked. Security by obscuring (exposing RDP on non-standard ports) has also gone up, and is not effective versus a determined attack. If your goal is to be secure, history has shown very well that obscurity does not at all work.

    Gil Rapaport wrote a great article about this over on our sister site, Security Boulevard. The only thing I would add is to put it on a Virtual  Private Network (VPN) or RD Gateway with 2FA, if you can. Some organizations still don’t have access to VPN services, but if you do, and RDP isn’t running through them, get to cracking.

    Some areas of the world are coming out of lockdown, but the amount of remote work will not drop to the levels it once was. Not soon, probably not ever. The only thing that was holding up remote work for a wide selection of office jobs was the belief that present was better. Some organizations, via forced remote, have learned that the work can indeed be done by people not warming a seat at HQ.

    So don’t put it off. Make certain you are protected. Sleep soundly at night, knowing that the easy vector for attackers right now is protected for your organization. And keep kicking remote rear. Systems are still running, even with the wild changes that came suddenly, and that’s all you–whether your organization recognizes you or not.

  • Cameyo Introduces RDP Port Shield Technology to Protect Remote Servers from Brute Force Attacks and Ransomware, Further Easing Cloud Migration

    Company Also Releases a Free, Open Source RDP Monitoring Tool to Help All Organizations Identify Attacks in Their Environments

    CARY, N.C. – Sept. 18, 2019 – Cameyo, the cloud-native virtual application delivery platform that brings any Windows application to any device from the browser, today introduced its new RDP Port Shield security technology to proactively protect customers from the dramatic increase in RDP vulnerabilities across the industry, including brute force attacks and ransomware. And to empower all organizations with more data about potential threats to their networks when using RDP or Citrix, Cameyo is also releasing a free open source RDP monitoring tool – RDPmon – that any organization can use to identify the attacks taking place over RDP in their environment. By helping organizations identify and proactively protect against these threats, Cameyo seeks to further ease cloud migration by helping to mitigate the related security concerns.  

    2019 has seen a dramatic increase in ransomware and brute-force attacks, with the latest McAfee Labs Threat Report revealing that ransomware increased by 118% in the first quarter of 2019, and that access is increasingly being gained via brute-force attacks to open and exposed remote access points such as RDP. Cameyo’s own research into brute force attacks revealed that the average internet-connected server currently faces 150K brute force-triggered password attempts per week.

    Dynamic Protection with RDP Port Shield

    To protect customers from these RDP-based vulnerabilities, Cameyo’s RDP Port Shield is the first built-in security technology of its kind that automatically closes RDP ports to the entire world, and then dynamically opens and closes them specifically to authenticated users, based on white-listed IP addresses, only when needed. Cameyo RDP Port Shield works by creating and managing an RDP white-list rule in real-time on the server, through Windows Firewall. 

    “As businesses embrace the cloud and target use cases for virtual desktop and virtual application delivery technologies to provide their users with access to critical applications, they are exposed to leaving RDP ports open to the world, creating the vulnerabilities that lead to brute-force attacks and ransomware,” said Mark Bowker, Senior Analyst at Enterprise Strategy Group (ESG). “Cameyo’s approach to RDP security extends and highlights their commitment to keeping their customers’ networks, data, and users safe and secure.”

    Visibility for All with Open Source RDPmon

    To help every organization better monitor and identify the brute force attacks in their environment and to help protect against ransomware, Cameyo is also releasing a free, open-source tool called RDPmon. RDPmon provides the entire industry a powerful free tool for monitoring attacks so that IT professionals can quickly identify and understand these threats – providing the critical data they need to mitigate the issues.  

    Any organization can easily download and install the open-source RDPmon on an RDS/cloud server for free from GitHub. After a quick guided configuration, IT admins will be provided with two views: 

    • A tab showing the total number of attempted connections to their servers
    • A tab that identifies the applications that are in use on each server, the number of people using RDP, and the programs being utilized by each user. 

    RDPmon will also provide insight into any unintentional or non-approved software in use on the server. All information collected by RDPmon remains completely private as it remains on-premise in the user’s environment – Cameyo cannot access any data. 

    “Organizations of all sizes face a myriad of roadblocks on their way to digital transformation, and the security concerns surrounding cloud migration – especially in light of the dramatic rise of RDP-based attacks – are top of mind for executives in every industry,” said Andrew Miller, co-founder and CEO of Cameyo. “Cameyo understands that the productivity gains of virtual application delivery cannot come at the cost of security, and we have built the Cameyo platform from the ground up to protect our customers and their users. We created RDPmon because we believe the ability to identify the RDP-related vulnerabilities in your environment should be freely available to all. And RDP Port Shield is just the latest of our security advancements as we continually protect our customers from an evolving threat landscape.”

    Pricing and Availability

    The Cameyo RDP Port Shield technology has been rolled out to all users of the Cameyo platform. Cameyo customers are not required to take any action in order to utilize this feature – it is now active for all users of the platform, and is included at no additional cost. The open-source RDPmon tool can be downloaded for free at https://cameyo.com/rdp-monitoring/ and the source code can be downloaded on GitHub at https://github.com/cameyo/rdpmon.

    About Cameyo

    Cameyo is a cloud-native virtual application delivery platform that enables the secure delivery of Windows desktop applications to any device from any browser. As organizations pursue Digital Transformation, they hit a common roadblock during their shift to the cloud – the inability to deliver their legacy Windows applications from the cloud. Cameyo solves this issue by providing everyone with seamless access to their Windows productivity apps on any device, from any HTML5 browser. Hundreds of enterprises and organizations utilize Cameyo’s virtual application delivery platform to deliver Windows applications to tens of thousands of users worldwide. To learn more, visit cameyo.com.