With over 50 percent increase in vulnerable remote connections as a result of the COVID-19 Pandemic, Kenya based Serianu has suggested nine measures that will help organisations to protect themselves against vulnerable remote connections.
Many organizations in Africa have been forced to transit their workforce to work from home with their IT departments re-architecting their environments to allow for remote access.
Globally, the use of remote access technologies like RDP (Remote Desktop Protocol), VPN (Virtual Private Network) have skyrocketed 41 percent and 33 percent, respectively, since the onset of the Coronavirus (COVID-19) outbreak.
Serianu, a cybersecurity analysis company noted that for organisations to protect themselves, it is important to remember any time they try to access something remotely there is a risk. And because Remote Desktop Protocol fully controls a system, they should regulate, monitor and manage who has access closely.
The company recommended the following measures:
- Enable strong passwords and account lockout policies to defend against brute-force attacks.
- Use two-factor authentication.
- Inventory all remote access applications — VNC/Teamviewr/Anydest/RDP/GoToMyPC — and check that their versions are up-to-date. If you have doubts about their reliability, stop using them. If you intend to continue deploying them, be sure to upgrade to the latest version.
- Audit your network for systems using RDP for remote communication. Disable the service if unneeded or install available patches. Users may need to work with their technology vendors to confirm that patches will not affect system processes.
- Enable logging and ensure logging mechanisms capture RDP logins. Keep logs for a minimum of 90 days and review them regularly to detect intrusion attempts.
- Ensure third parties that require RDP access are required to follow internal policies on remote access.
- Regulate and limit externally to internal RDP connections. When external access to internal resources is required, use secure methods, such as VPNs, recognizing VPNs are only as secure as the connected devices.
- Prevent scanning for an open port by Change default RDP port from 3389 to another unused port, Block RDP (port 3389) via a firewall, Restrict RDP to a whitelisted IP range
- Prevent attackers from gaining access if RDP is enabled by creating a Group Policy Object (GPO) to enforce a strong password policy.
