We see direct, unprotected RDP exposure often enough in new-client audits that it’s worth writing down plainly: if a machine is reachable by RDP directly on your public IP, that’s not a convenience feature, it’s an open door that’s being actively tried by automated scanning tools right now, regardless of whether anyone has any specific interest in your business. Our recent case study covers what happens when this goes wrong. This is what we set up instead.
Why direct RDP exposure gets found so fast
The internet is continuously scanned for open RDP ports (typically 3389, though moving the port doesn’t meaningfully help, scanners check ranges, not just the default). Once found, an exposed RDP endpoint gets targeted with credential-stuffing and brute-force attempts automatically, at scale, with no need for the attacker to have any specific interest in your business. It’s opportunistic, not targeted, which is exactly why it happens to businesses that would otherwise say “why would anyone target us?”
Option 1: VPN
The most common fix, and a reasonable one for most small businesses: remote users connect to a VPN first, authenticate there, and only then can reach internal systems including RDP, which itself is no longer reachable from the open internet at all. Pair this with MFA on the VPN connection itself, not just the RDP login, since that’s the actual front door now.
Option 2: An RDP gateway
A properly configured Remote Desktop Gateway sits in front of RDP connections, handling authentication (ideally with MFA) and encryption before a connection ever reaches the target machine, rather than exposing the machine’s own RDP service directly. This is a reasonable middle ground where a full VPN rollout isn’t practical yet.
Option 3: Zero Trust Network Access
For businesses with a more distributed team or multiple systems to reach, ZTNA grants access to specific resources individually and continuously verifies the connection, rather than a single login granting broad network reach. See our VPN vs. Zero Trust comparison for when this is worth the extra setup over a standard VPN.
What we’d never recommend
- Direct port-forwarding of RDP (or any admin interface) straight to the internet
- RDP access without MFA on the connection, regardless of which method is used
- “Security through obscurity” fixes like changing the default port and calling it solved
- Remote access with no logging, so a breach attempt, successful or not, goes unnoticed
If you’re not sure what you currently have exposed
A port scan against your business’s public IP takes us minutes and tells us definitively whether this is already a problem. This is one of the first things we check in any new engagement, and closing an exposed remote-access port is often the single highest-impact fix we make in an initial assessment. Our Remote Access Security service covers the full setup, start to finish.