Cyber Insurance Blog

How a Newly-Remote Workforce Exposes Employers to RDP Vulnerability (And What Your Clients Can Do)

In March 2020, as the COVID-19 virus began to spread, thousands of Americans shifted to working and learning from home. With a reliance on technology like never before, meetings became virtual, kitchen tables became desks, and dress codes became non-existent.

As this global pandemic shows no signs of slowing down, industries of all kinds are forced to plan on connecting remotely for the foreseeable future, adding new challenges to their cyber security posture. With workers across the country logging into work every day from their personal laptop, companies are faced with RDP vulnerability as they’ve never seen before.

What is RDP Vulnerability?

A young woman in a blue polka-dot button-down sits at home at a wooden table and works from her laptop.

Remote desktop protocol (RDP), is a software that allows users access to their work-related resources/data from a remote device. While RDP vulnerability was already a growing concern, it grew exponentially as so many organizations were forced to suddenly push their entire workforce into remote positions in March 2020.

With these new, hastily remote infrastructures, many systems were out of date, stretched beyond their limits, or flawed, allowing hackers to take advantage and gain unauthorized access.

How Can RDP Be Hacked?

The FBI recently released a number of potential vulnerabilities that Microsoft RDP faces:

CryptoAPI Spoofing Vulnerability

A hacker uses a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a legitimate source.

Windows RD Gateway Vulnerability

A hacker connects to the target system using RDP and sends specially crafted requests.

Windows Remote Desktop Client Vulnerability

A hacker connects to a malicious server where they could execute arbitrary code on the computer of the connecting client.

As these attacks continue to evolve, it’s important that your clients stay up to date on the latest threats.

Steps You And Your Clients Can Take to Reduce Remote Desktop Vulnerability

A young woman wearing orange overalls and a t-shirt works from her laptop at home.

Working remotely has created new sets of challenges. The last thing most business owners want to focus on is cyber security. However, it’s now more important than ever for your clients to proactively consider how secure their RDP is.

Here are four simple steps they can take—immediately—to reduce their risk:

Use Strong Passwords

One of the easiest ways a hacker can gain unauthorized access through an insecure RDP connection is with a weak password. A strong password should contain both upper and lowercase letters, numbers, and a symbol. The longer the password, the harder it will be to crack.

Enlist Two-Factor Authentication

This is a second layer of security, after the password. This requires the user to input a second piece of information to validate their identity. Even if a hacker is able to crack a password, they’ll have a second hurdle to overcome before they can gain access.

Update Software Regularly

Whether your clients use Microsoft, Apple, or another operating software, new vulnerabilities are discovered and patched every day. If your clients aren’t regularly updating their systems or patching known errors, they’re leaving themselves significantly exposed. When possible, it’s best to allow automatic updates to ensure these don’t slip through the cracks.

Purchase a Cyber Insurance Policy

While it’s important for your clients to take precautions to reduce the chances of a cyber attack through RDP, the probability that an attack will be successful remains high. Purchasing a cyber policy helps your clients ensure that they’ll be protected if they do fall victim. With a cyber insurance policy in effect, your client will be covered from a wide range of potential costs and damages, including:

A young woman with brown hair wearing a white button-down holds a virtual meeting from her home office.
First-Party Coverages

IT Forensic Costs
Notification Costs
Credit Protection Costs
Crisis Management Costs
Crime & Social Engineering Costs

Third-Party Coverages

Costs related to a breach of personally identifiable information (PII)
Third-party claims related to:

Breach of contract
Negligent protection of data
Network security breaches
Transmission of software viruses
Payment card industry (PCI) fines/penalties and assessments

Additional Coverages

Multimedia coverage
Cyber extortion
Cyber business interruption
Hacker damage or digital asset damage

Address RDP Vulnerability With ProWriters

A father works from his kitchen table and holds his cell phone in one hand and his toddler daughter in the other.

Is RDP secure? Nothing on the internet is 100% secure these days. It’s important to plan for the inevitable and protect your clients. With the proper precautions and a cyber insurance policy in place, your clients will be ready to bounce back, should they fall victim to an attack.

For more advice on protecting your clients, download our FREE whitepaper, The Six-Step Guide to Becoming Your Clients’ Cyber Expert. Here, we’ll help you learn more about identifying your clients’ cyber exposures, reducing their risk, and mitigating any potential damages.

Feel free to contact us or speak with a ProWriters expert at (484) 321-2335 with any questions.