devopsy.kinsta.cloud

Tag: VPN

  • No Excuses: Lock Down RDP

    No Excuses: Lock Down RDP

    We’ve been at the “everyone working remote” thing for months now, and still there are horror stories of people being attacked via Remote Desktop Protocol (RDP). Early on, it was understandable if not acceptable—but we’re not early on any more.

    During the rush of doing whatever it took to help people work from home, exposed RDP was just one of many stories we heard from systems operators, helpdesk and systems admins. Stories of people carrying desktops home, or thinking that tethering to their phone was a “good enough” internet solution predominated. But those issues are clearing up, and they’re specific to a company or a subset of employees. RDP seems to be more persistent.

    According to Shodan (article last updated end of March 2020), RDP use has spiked—and unprotected RDP use has spiked. Security by obscuring (exposing RDP on non-standard ports) has also gone up, and is not effective versus a determined attack. If your goal is to be secure, history has shown very well that obscurity does not at all work.

    Gil Rapaport wrote a great article about this over on our sister site, Security Boulevard. The only thing I would add is to put it on a Virtual  Private Network (VPN) or RD Gateway with 2FA, if you can. Some organizations still don’t have access to VPN services, but if you do, and RDP isn’t running through them, get to cracking.

    Some areas of the world are coming out of lockdown, but the amount of remote work will not drop to the levels it once was. Not soon, probably not ever. The only thing that was holding up remote work for a wide selection of office jobs was the belief that present was better. Some organizations, via forced remote, have learned that the work can indeed be done by people not warming a seat at HQ.

    So don’t put it off. Make certain you are protected. Sleep soundly at night, knowing that the easy vector for attackers right now is protected for your organization. And keep kicking remote rear. Systems are still running, even with the wild changes that came suddenly, and that’s all you–whether your organization recognizes you or not.

  • Citrix Makes Case for VPN Alternative

    Citrix Makes Case for VPN Alternative

    Citrix this week announced it will make its remote access tool that enables users to efficiently access their desktop PCs more widely available via the cloud.

    Gabe Carrejo, senior program manager for Citrix, said Remote PC Access provides a more efficient alternative to the virtual private networks (VPNs) that most organizations currently rely on to enable employees to remotely access their desktops.

    To use Remote PC Access, an IT administrator installs a small client on the remote systems. The client provides access to a range of networking services that Citrix makes available on top of its Independent Computing Architecture (ICA) remoting protocol to create a Secure Sockets Layer (SSL) tunnel, which Citrix markets collectively as High-Definition Experience (HDX) Technology.

    To make it easier to access a desktop PC remotely, Remote PC Access installs agent software that IT teams can now push out to an endpoint as long as they have licensed any one of several Citrix services, said Carrejo. In most cases, IT teams will employ a platform such as Microsoft System Center to deploy agent software on an endpoint.

    In the rush to provide employees with remote access almost overnight to help combat the COVID-19 pandemic, many organizations turned to VPN offerings they were using to provide a small number of employees with remote access. However, with almost every employee trying to access the same VPN, many of those IT teams have encountered network bandwidth issues. What’s more, many of the desktop applications installed in the office are not especially tolerant of the latency a VPN adds to the equation.

    Citrix has long been making the case for ICA as a more efficient protocol for providing remote access to desktops. Now, in response to the COVID-19 pandemic, the company is making it easier for IT teams to distribute HDX agent software across as many remote endpoints an IT organization needs to support. End users can then access applications on their office desktops remotely via any HTML5-compatible browser or virtual desktop software provided by Citrix.

    Carrejo said more organizations are re-evaluating their reliance on VPNs as it becomes clear that what once viewed as business disruption has become the “new normal.” Many organizations are looking closely at how many employees they need to come into an office when their job role may not require it. Remote computing is now a core element of a larger business continuity strategy. As such, Carrejo said many organizations are looking to find a way to provide more efficient remote access to office-based desktop systems while contemplating a possible transition to a virtual desktop infrastructure (VDI) platform deployed in a local data canter or in the cloud.

    It’s too early to say to what degree Windows desktops will be moving to VDI platforms. In the meantime, however, the remote access protocols that IT teams rely on suddenly matter a lot more.

  • Cato Networks Offers Instant SD-WAN Service

    Cato Networks Offers Instant SD-WAN Service

    Cato Networks has added an instant-on capability to its software-defined wide area network service (SD-WAN) service to make it easier for IT teams to provide employees with remote access to applications.

    Dave Greenfield, technology evangelist for Cato Networks, said rather than having to configure and install a virtual private network (VPN) client on every device to access applications, IT teams can simply share a URL to provide network access via a single sign-on protocol without requiring client software. At a time when many IT teams are scrambling to allow every employee to work at home to help combat the spread of the COVID-19 coronavirus, the Cato Software Defined Perimeter (SDP) service provides an alternative approach to achieve that goal at scale, he said.

    The Cato SDP network is an instance of a global SD-WAN service co-managed by Cato Networks. IT teams still control who gains access to what applications using multifactor authentication, while Cato Networks manages the underlying network and security infrastructure, including all the firewalls and endpoint protection software. As such, Greenfield said, Cato SDP is one of the first instances of a service based on what Gartner is now describing as a secure access service edge (SASE) architecture.

    Greenfield said trying to scale access using legacy VPN software is problematic because it requires IT teams to acquire more software licenses and bandwidth, while end users are provided with passwords to access the corporate network, which can be easily hacked. And, perhaps most problematic, most VPNs limit the number of simultaneous users allowed on the network.

    Cato SDP provides access to a zero trust network environment that only provides access to applications that end users have been specifically authorized to use, said Greenfield, noting all of that can be accomplished in as little as 10 minutes.

    Cato SD-WAN

    Since the beginning of the COVID-19 outbreak, Greenfield said Cato Networks has seen a sharp increase in usage of its global network, which consists of points-of-presence residing in third-party data centers distributed around the world. This setup makes it possible to optimize application experiences based on where end users are physically accessing the internet.

    It may be a few months to as long as two years before the COVID-19 pandemic subsides. What today may be viewed as a singular disruptive event could very well be a harbinger for how organizations will need to work from now on. Even once IT teams get everyone in their organization up and running from home, many of them will have to ask themselves how long they are prepared to manage IT as a remote service. The emergence of SASE-based services provides an alternative co-managed approach that allows IT teams to rely on an external service provider without having to give up control over their applications to a managed service provider (MSP).

    Naturally, it may be a while before the current crisis subsides enough for organizations to realize they may need to fundamentally change the way they consume IT. The only thing that is for certain right now is that conversation is all but inevitable.

    — Mike Vizard