this is Susan Bradley for CSOonline this week we're going to talk about
Remote Desktop and specifically certain tweaks that we can do to make it more
secure so how's everyone doing we already know that it's going to be at
least until April 30th work until the United States comes out of work from
home quarantine guidelines from the president and we're probably making sure
that our home users are set up they can remote in your bandwidth is holding up
but you're also probably like me a little concerned that your users will
click on something they're not supposed to and bring something into the network
so what things can you do to beef up that remote desktop first and foremost I
hope that no one is opening up 3389 directly to the web there's a program
called Tia's Greiner it's been around for years and it's long been used to
brute-force the password on open connections and don't think about moving
that 3389 to another port that doesn't work either attackers just look for the
kinds of transmission that RDP or or TS gateway comes that telltale pattern is
seen by the attackers and they look for it so don't just move yourself to
another port and think that's good enough you want to make sure that your
servers and specifically your workstations are patched remember that
if you have Windows 7 workstations that you place back into service it's not too
late to get those ESU packages extended security updates can still be purchased
from Windows 7 then you'll be deployed so again even for older machines that
you're putting back into service make sure they're patched next remember that
you can add two-factor authentication even to Remote Desktop there's platforms
out there that will be able to add it to existing servers and just a reminder the
issue of blue keep the vulnerability called blue creep is still out there so
you want to make sure you're fully patched and look to see if you can able
network level authentication for RDS servers remember you can go to computer
policies windows components remote desktop
services and go to the remote desktop host setting and go into security click
on that require user authentication for remote connections by using network
level authentication you want to set it enabled and you want to click apply this
setting needs to be done on the remote desktop session host role so think of
where you've got those RDS servers out there and put that in out nla setting in
place next you want to shut off the ability for users to shutdown or restart
often users that are not used to Remote Desktop session don't realize that
they're logging into an environment where others are involved so you'll want
to go to user configuration administrative templates and find the
setting for Start menu and taskbar find the option that says remove and prevent
access to the shut down restart sleep and hibernate commands and you want to
enable that another setting you'll want to do is for performance because if
performance is not good your users will not be happy so go back to computer
configuration administrative templates windows components and then go into
Remote Desktop Services find the remote desktop session host and then go to
remote session environment under here you'll want to adjust several settings
you'll want to limit the maximum color depth you'll want to enforce removal of
the what remote desktop wallpaper this will slow down an environment really
fast so you want to make sure you enable this so that there's no background image
you'll want to go into remote FX settings and optimize that visual
experience and you want to pick your compression from remote FX data you want
to enable this and optimize to use less network bandwidth and finally review the
settings under configure remote FX adaptive graphics and you want to
optimize that for minimum bandwidth usage
finally you'll want to review the TLS and SSL settings in particular you want
to go out to iis crypto and actually run it against the server and tweak those
settings for Server 2008 r2 you'll need a patch to support TLS 1.1 or 1.2 for
RDP you'll need to install specifically KB 308 zero zero seven nine in order to
support the higher TLS settings if you have Windows Server server 2008 you'll
need to update the RDP client to 8.1 version bottom line reviewed the
settings in KB two four five zero three zero in order to restrict the SSL
encryption levels and put them up to hire better settings finally look two
newer ways to provide virtual desktops Microsoft is a new offering called
Windows a virtual desktop that can be deployed to users firms are accelerating
moving to Windows a virtual desktop right now Microsoft's indicated they had
a massive growth in this and they have lots of resources online to help you
with this initial deployment and finally don't forget about the resources on the
IDG Tech Talk YouTube channel there was just a recent bit YouTube video about
why new remote work policies attract hackers it's an interesting video and
you should check it out until next time stay safe stay secure