Is Remote Desktop Protocol (RDP) Secure? A Cybersecurity Expert Explains the Risks

Remote Desktop Protocol (RDP) has long been a popular tool for IT admins and employees to remotely access and control computers. But the shift to widespread remote work in 2020 due to the COVID-19 pandemic caused RDP usage to skyrocket by over 40% almost overnight.[^1] This surge in RDP activity has also attracted increasing attention from cybercriminals looking to exploit vulnerabilities in the protocol.

As an information security professional with over a decade of experience in network defense, I‘ve seen first-hand how unsecured RDP connections can serve as an open backdoor for attackers. In this article, I‘ll provide an in-depth look at how RDP works, analyze the most critical security risks, and share expert recommendations to help organizations harden their remote access infrastructure against modern threats.

How Remote Desktop Protocol Works

RDP is a proprietary protocol developed by Microsoft to allow users to connect to another Windows computer over a network. It provides remote display and input capabilities over a secure network connection, enabling the remote user to view and control the connected computer as if they were sitting directly in front of it.

When an RDP connection is established, the following process occurs:[^2]

1. The client computer (remote user) sends an initial connection request to the remote computer (host).
2. The host authorizes the connection request and exchanges basic settings and security information with the client.
3. The client verifies the security of the connection and transmits its own security and settings parameters.
4. The host sends licensing and permission data to the client to confirm a valid connection.
5. Both computers perform compatibility checks and establish the final remote desktop connection.
6. The remote user‘s mouse, keyboard, display, and other inputs/outputs are redirected over the network to the host.

While RDP traffic is encrypted by default using RC4 cipher with a 128-bit key, multiple security flaws have been discovered over the years. Legacy versions of RDP use weaker encryption protocols like SSL 2.0 which are vulnerable to man-in-the-middle attacks.[^3]

RDP Usage and Vulnerability Statistics

Even before the pandemic, RDP was a leading attack vector for cybercriminals. But the sudden shift to remote work in 2020 expanded the attack surface by exposing more RDP servers directly to the internet.

Consider these alarming RDP security statistics:

• Internet-wide scans detected a 40%+ surge in exposed RDP ports during March 2020.[^1]
• RDP is now the most popular attack vector for ransomware, accounting for 70-80% of attacks.[^4]
• The number of RDP brute-force attacks grew by 400% during 2020.[^5]
• Attacks against RDP surged by another 768% during 2021.[^6]
• Cybercriminals buy and sell over 50,000 compromised RDP credentials on the dark web per quarter.[^7]

Common RDP exploits used by attackers include:

Method	Description	% of Attacks
Brute force login	Guessing username/password combos	35%
Phishing	Tricking users into revealing credentials	19%
Exploit kits	Automated tools to scan for vulnerabilities	14%
Malware	Trojans/backdoors installed via other vectors	12%
Credentials for sale	Compromised logins sold on dark web markets	9%
Misconfiguration	Open ports, lack of network segmentation	8%

Table 1: Most common RDP attack methods and prevalence[^4][^7]

The rise in RDP-enabled ransomware has been especially concerning. A recent survey by Symantec found that 100% of IT and security decision-makers are concerned about ransomware attacks, and 56% have already experienced at least one attack.[^8]

Ransomware attacks cost businesses an average of $283,000 per incident due to IT downtime, lost orders, operational disruption, and recovery costs.[^9] The FBI estimates that ransomware losses exceeded $29.1 million in 2020 alone.[^10] RDP-enabled ransomware families like SamSam and GandCrab have caused millions in damages to corporations, hospitals, and city governments worldwide.

How to Secure RDP Against Modern Threats

Properly securing RDP against current threats requires a multi-layered security approach. As Sami Laiho, Microsoft MVP and ethical hacker explains, "RDP is a maintenance tool, not a remote work tool. Exposing it to the internet without any additional protection is reckless."[^11]

Here are best practices every organization should implement to harden their RDP deployments:

Require Multi-Factor Authentication

Enforce the use of multi-factor authentication (MFA) for all RDP logins, without exception. Requiring a second factor like a hardware token or mobile push notification prevents attackers from accessing systems with compromised/stolen credentials alone.

Use Strong Access Controls

Practice the Principle of Least Privilege and only grant RDP access to users who absolutely require it. Restrict connections to specific known IP addresses using an allow list. Configure Account Lockout policies to block brute force login attempts.

Disable Standard RDP Port

Change the default RDP network port from TCP 3389 to an arbitrary unused port. This easy configuration change can thwart automated scanners and script kiddies. Use a port above 10000 to bypass most port scans.

Enable Network Level Authentication

Turn on Network Level Authentication in Windows Remote Desktop Services. NLA requires connecting users to authenticate before a remote desktop connection is established. This stops connection attempts using invalid credentials before a full session starts.

Patch All the Things

Keep Windows systems and RDP clients updated with the latest security patches. Many older RDP vulnerabilities are still widely exploited in the wild. Apply updates as soon as possible to prevent attacks.

Use an Encrypted VPN Tunnel

Force all remote RDP connections through an encrypted VPN tunnel. This provides an additional layer of encryption and authentication while hiding RDP traffic from network sniffers. Choose a reputable VPN service and avoid free offerings.

Implement Endpoint Detection and Response

Deploy an Endpoint Detection and Response (EDR) security solution to monitor for suspicious RDP connections and post-compromise activity. EDR solutions use behavioral analysis and machine learning to detect infections and unauthorized access attempts in real-time.

Alternatives to RDP for Secure Remote Access

RDP was designed for technical management of servers by system administrators, not as a general remote access solution. If your organization needs to provide remote desktop capabilities to end-users, several modern solutions offer a more secure alternative:

• Splashtop – Cross-platform remote access solution with built-in security features like device authentication, session encryption, and multilevel password options.
• LogMeIn – Cloud-based remote access service with support for multi-factor authentication, user access management, and security auditing.
• Teamviewer – All-in-one solution for remote support and collaboration with end-to-end 256-bit AES encryption, granular user permissions, and brute force protection.

For IT admins that still require cmd line access to servers, legacy tools like Secure Shell (SSH) or Virtual Network Computing (VNC) used with a VPN provide a lightweight option.

The Bottom Line on RDP Security Risks

The massive growth in RDP usage combined with lax security practices have made it a prime target for cybercriminals. Ransomware gangs in particular are drawn to RDP as an easy way to gain initial access and pivot through networks.

But by following remote access security best practices like enforcing MFA, patching vulnerabilities, using strong access controls, and monitoring for suspicious activity, organizations can significantly reduce their risk of falling victim to an RDP-based attack.

No solution is completely immune from threats, but newer alternatives to RDP provide more secure options for general remote access needs. IT and security leaders must weigh the business requirements for remote access against the risks and choose the solution that best meets their needs.

As the remote workforce continues to grow, getting a handle on RDP and remote access security will only become more critical. Hopefully this article has shed light on the risks and provided a framework for organizations to better secure their remote access infrastructure. Stay safe out there!

[^1]: Remote Desktop Usage Increases 40% As More Employees Work From Home — NetScout
[^2]: Secure Remote Access Using Remote Desktop Protocol — Microsoft
[^3]: Microsoft Security Bulletin MS12-020 — Microsoft
[^4]: Ransomware & RDP Attacks — Security Boulevard
[^5]: RDP Attacks Up 400% — Kaspersky
[^6]: RDP Attacks Surge 768% — Threatpost
[^7]: Compromised RDP Credentials Sold on Dark Web — Flashpoint
[^8]: Ransomware Survey Results — Symantec
[^9]: Ransomware Costs Businesses $283,000 Per Attack — Acronis
[^10]: Ransomware Losses Top $29M in 2020 — FBI
[^11]: The Truth About Remote Desktop Vulnerabilities — TechGenix