RDP attacks on the rise, Kaspersky experts offer advice

Employees hastily placed on remote work setup kept many businesses afloat when pandemic hit in 2020. Unfortunately, it was also remote work that caused some headache for companies that were struck with RDP attacks, which are not even going away soon, according to Kaspersky.

RDP or remote desk protocol is Microsoft's proprietary protocol that enables a user to connect to another computer through a network of computers running Windows. RDP is widely used by both system administrators and less-technical users to control servers and other PCs remotely but this tool is also what intruders exploit to penetrate the target computer that usually houses important corporate resources.

Microsoft 365 remains the preferred productivity software in the business sphere, followed by Google Workspace. When devices are outside the company's local network, away from the protection of the IT department, confidential information will always have a huge potential to be stolen or lost due to carelessness.

With the first wave of lockdowns, computers that have been hurriedly made available to remote workers were incorrectly configured. This scenario provided an opportunity for cybercriminals to launch attacks, particularly using brute-force attack attempts (systematically trying to find the correct username-password pair) to successfully get remote access to the target computer in the network, Kaspersky states.

Kaspersky general manager for Southeast Asia, Siang Tiong, says, "The experience during the pandemic has put forth a collective clamour all over the world to shift to a hybrid work setup. Sectors such as finance, information, management, and professional services have shown to benefit from working and collaborating remotely.

"The hike in RDP attacks during this period is not unique to the SEA region. Globally, this type of threat rose 120% from 2019 to 2021. Given that remote work is here to stay, we urge companies to seriously look into securing their remote and hybrid workforce to protect their data."

Kaspersky experts foresee that attacks on remote-access infrastructure (as well as collaboration tools) are unlikely to stop any time soon. So if you currently use RDP in your work, Kaspersky experts advise to take all possible protection measures, such as the following:

• Use different strong passwords to access different corporate resources
• Update all software and apps on employee devices to the latest version
• Enable access to your network or make RDP available only through a corporate VPN -Use Network Level Authentication (NLA)
• If possible, enable multi-factor authentication
• If you don't use RDP, disable it and close port 3389
• Give employees basic security awareness training which can be done online. Kaspersky and Area9 Lyceum have a free course to help staff work safely from home
• Ensure employees are equipped to securely work from home and know who to contact when faced with an IT issue
• Use a reliable corporate security solution that will be installed on all employee devices, as well as solutions for tracking equipment in case of loss. Choose one with network threat protection
• Where possible, use encryption on devices used for work purposes
• Ensure access to the latest threat intelligence to boost your protection solution
• Make backup copies of critical data