Remote access to the firm: RDP, VPN and shared accounts
Exposed access, updates and credentials: three checks to agree with the firm’s technician.
As staff began working from home, many firms took the quickest route to remote access: Remote Desktop (RDP, TCP port 3389) published directly on the internet through port forwarding on the router, or an SSL VPN enabled on the firewall and never updated again. Both require a technical check of the exposure and of the access measures. For the owner, the first step is to have a list of the remote access routes and of who is responsible for each.
Exposed RDP: what happens in the logs
An RDP service reachable from the internet receives continuous sign-in attempts, with common passwords and credentials leaked from other breaches. On the server, the Windows Event Log shows them as event 4625 (failed logon) in series, often against names such as administrator, scanner or reception. Event 4624 with logon type 10, by contrast, indicates a successful remote session: an unexpected time or address calls for a check with the account holder, without presuming a compromise from this indication alone. Remote Desktop should be placed behind a VPN or an RD Gateway with a second factor, with Network Level Authentication (NLA) enabled and an account lockout policy after a few attempts.
SSL VPN: the firmware matters more than the password
On perimeter devices, vulnerabilities are exploited shortly after publication. Some flaws in the FortiOS SSL VPN, such as CVE-2018-13379 and CVE-2023-27997, were used for months against devices that had not been updated. The point is not the brand of the firewall: it is that the firmware must be on the latest supported version and that the device must not be past the manufacturer’s end of support. The CISA KEV catalogue lists vulnerabilities known to be actively exploited and is a good filter for deciding what to update first.
Checks for your IT specialist
- An authorised scan, with an agreed scope, of the firm’s public address, for example nmap -Pn -p 22,445,3389,8443 followed by the IP: no administration service should respond. Port 445 (SMB) must never be exposed.
- Firewall firmware version and end-of-support date.
- A second factor on the VPN and a personal account for each member of staff: with a shared account it becomes impossible to reconstruct who connected and when, and a former member of staff keeps access until the password changes.
Local administrators
Often all the firm’s PCs have the same local administrator password, set on the day of installation. Once a laptop is compromised, the attacker extracts that credential and reuses it on all the other machines. Windows LAPS, built into Windows since the April 2023 updates, assigns a different password to each machine and rotates it automatically, at no licence cost. It reduces the risk of credential reuse across machines, which is also relevant to protecting the backups on the firm’s NAS.
For an overview of the typical risks for professional firms and to put in writing who can access what, the access control policy is a template to adapt.
