No Ports, No Problem: How ZeroTrust Reinvents RDP Security

Table of Contents

1. How Traditional RDP is Hacked, Leading To Its Failure?
Example of RDP Attack Patterns

2. Zero Trust RDP Revolution
2.1 Zero Trust RDP Vs. Traditional RDP
2.2 Zero Trust RDP Connection Flow

3. Check Point’s RDP Architecture

4.  Blueprint for Implementation of Zero Trust RDP
4.1 Phase 1: Exposure Elimination
4.2 Phase 2: Identity-Centric Controls
4.3 Phase 3: Advanced Protections
4.4 Check Point’s RDP-Specific Countermeasures

5.  Aligning Zero Trust RDP With The Frameworks

6.  Conclusion

Traditional Remote Desktop Protocol (RDP) setups make systems vulnerable to cyberattacks, leading to the loss of sensitive and private data. This is just like keeping the keys to your house at the front all the time, which allows anyone to use the keys and enter your house. Attacks on RDP servers are increasing with time, necessitating its solution. This article dives into the solution to increasing RDP server attacks.

Zero Trust Architecture (ZTA) solves the security problems for RDP by eliminating the need for accessing open inbound ports, as hackers use these for attacks on the RDP. The internal network initiates all connections by using reverse connectivity. This makes the ports safe, and they are not exposed to hackers. This makes it impossible for hackers to attack the RDP. For granting access, internal servers establish outbound connections, thus reducing the attack surface available for hackers. It protects against potential breaches and unauthorized access

Zero Trust Architecture eliminates the need for inbound ports. Therefore, there is no risk for external threats that target open inbound ports. ZTA starts its process when your system initiates an outbound connection for the securing gateway. The securing gateway plays the role of a middle layer, allowing only the authorized and authenticated users to connect. The gateway is connected to the device, after which the device is identified using protocols such as SSL/TLS. If the identity is confirmed, the device of user is given access. In this way, ZTA enhances the security of RDP by eliminating the need for open ports.

1. How Traditional RDP is Hacked, Leading To Its Failure?

The manner in which traditional RDP is hacked and fails is the following;

•     A[Attacker] –> B[Port Scanner]
•     B –> C[Find Open Port 3389]
•     C –> D[Brute Force Attack]
•     D –> E[Server Access]
•     E –> F[Lateral Movement]
•     F –> G[Ransomware Deployment]

Example of RDP Attack Patterns

1. The Crucial First 15 Minutes For Taking Over an RDP Server

• Hacker accesses the dark web and buys RDP credentials.
• The hacker accesses the exposed server using the RDP credentials.
• Gets domain admin privileges by using tools such as Mimikatz.

2. Silent Observation

• Hackers maintain their access to the RDP server for as many months as they want.
• Steals sensitive data.
• Hackers trigger ransomware for maximum disruption during the audit season.

2. Zero Trust for RDP Reverse Architecture

The internal system creates a secure outbound tunnel to a broker or central gateway.

You open any web browser to access the secure URL (https://remote.yourcompanydomain.com).

Your request is authenticated with multi-factor authentication (MFA) after logging in.

The secure gateway uses the outbound tunnel, which was created by the internal system, for bridging your session to the internal system, eliminating the need for open inbound firewall ports.

2.1 Zero Trust RDP Vs. Traditional RDP

2.2 Zero Trust RDP Connection Flow

•     User->>+Gateway: Request RDP
•     Gateway->>+IdP: Verify MFA + Device
•     IdP–>>-Gateway: Auth Result
•     Gateway->>+Policy Engine: Check Rules
•     Policy Engine–>>-Gateway: Approved/Denied
•     Gateway->>+RDP Host: Create Tunnel
•     RDP Host–>>-User: Secure Session
•  
•     loop Every 5 mins
•         Gateway->>User: Re-verify
•     end

4.  Blueprint for Implementation of Zero Trust RDP

4.1 Phase 1: Exposure Elimination

1. Finding and Fixing Exposed RDP Ports

Use Powershell to analyze and gather information about the system.

$computers = Get-ADComputer -Filter *

$computers | ForEach-Object {

    if ((Test-NetConnection -ComputerName $_.Name -Port 3389 -WarningAction SilentlyContinue).TcpTestSucceeded) {

        Write-Warning “EXPOSED: $($_.Name)”

    }

}

2. Deploy An Access Broker

Deploy an access broker that acts as a gateway between RDP servers and users. It enforces Zero Trust features by restricting direct exposure to the internet, logging all access and validating all attempts for connections. The best access brokers are Azure AD App Proxy, Tailscale, and Cloudflare Tunnel.

4.2 Phase 2: Identity-Centric Controls

Following is an example of an Attribute-Based Access Policy (YAML):

access_policies:

– resource: sql-admin-vdi

  allowed:

  – group: “Database Admins”

  – location: “US,CA”

  – time: “Mon-Fri 8AM-6PM EST”

  requirements:

  – mfa: true

  – device_compliance: true

  – cert_expiry: >7days

4.3 Phase 3: Advanced Protections

• Session Watermarking

# Pseudocode for forensic watermark

def inject_watermark(session):

    user = session.auth_identity

    watermark = f”{user.name} | {datetime.now()} | {session.id}”

    overlay_watermark(watermark, opacity=0.15)

• Just-In-Time Elevation

A[Admin Request] –> B[PAM System] 

B –> C{Approved?} 

C –> |Yes| D[2-Hour Session] 

C –> |No| E[Access Denied] 

D –> F[Automatic Logoff]

Some implementation using PowerShell:

To facilitate real-time access to virtual machines through PowerShell, utilize the official Microsoft Defender for Cloud PowerShell command.

Configure just-in-time virtual machine (VM) access for a specific VM, adhering to the following guidelines:

• Shut down ports 22 and 3389.
• Establish a time limit of 3 hours for each request, allowing them to be opened only if approved.
• Grant the user who is requesting access the ability to control the source IP addresses.
• Grant access to the user who has requested it, ensuring a successful session after verifying their approval.

The following PowerShell commands generate this JIT configuration:

1. Define a variable that stores the on-demand virtual machine access rules for a specific VM.

$litPolicy = (@{

    id=”/subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Compute/virtualMachines/VMMAME”;

    ports=(@{

        number=22;

        protocol=”*”;

        allowedSourceAddressPrefix=@(“*”);

        maxRequestAccessDuration=”PT3H”),

    @{

        number=3389;

        protocol=”*”;

        allowedSourceAddressPrefix=@(“*”);

        maxRequestAccessDuration=”PT3H”})

})

2. Insert the just-in-time VM access rules into an array:

$JitPolicyArr=@($JitPolicy)

3. Configure the on-demand virtual machine access rules for the chosen VM:

Set-AzJitNetworkAccessPolicy -Kind “Basic” -Location “LOCATION” -Name “default” -ResourceGroupName

“RESOURCEGROUP” -VirtualMachine $litPolicyArr

4.4 RDP-Specific Countermeasures

• Protocol Exploit Mitigation:

Check Point’s HTML5 blocks vulnerabilities in the RDP protocol through CloudGuard IPS signatures.

• Credential Theft Prevention:
  
  

Rendering of Check Point’s HTML5  neutralizes malware, which is used for targeting RDP clients, making the credentials fail to reach the endpoint.

5.  Aligning Zero Trust RDP With The Frameworks

6.  Conclusion

The future of Remote Desktop Protocol (RDP) is safe with the Zero Trust revolution. Zero trust has greatly enhanced the security of RDP servers. It protects the RDP servers from cyberattacks, which were very frequent with the traditional RDP. It leaves no vulnerabilities for hackers to exploit and use for access to RDP servers.

The Zero Trust Architecture (ZTA) has effectively secured remote access by eliminating the vulnerabilities and weak points of traditional RDP. It has enforced identity centric controls, elinninated exposed inbound ports and integrated advanced protections like just in time (JIT) access and session watermarking. ZTA gas reduced the attack surface for hackers. The approach used by ZTA also complies with all major security frameworks. It has reduced the risks, such as ransomware and credential theft. Organizations can keep their sensitive data safe from hackers by using ZTA, eliminating the risk of unauthorized access. ZTA protects its remote desktop infrastructure against continuously evolving cyber threats. Finally, with ZTA, the era of insecure and unsafe RDP is over.