Remote Access for a Small Business: VPN, Remote Desktop and Security

One employee works from home, another is on the road, and all of them need to reach the office file server or the accounting software. Most of the time that goes through a virtual private network (VPN), sometimes through remote desktop opened to the internet. The Canadian Centre for Cyber Security points out that remote work adds vulnerabilities to the organization’s own (ITSAP.10.016). Here is what it recommends, along with the American CISA and NSA.

What a VPN does, and what it does not

A VPN encrypts the data travelling between the employee’s device and the company network, across a network that cannot be trusted (ITSAP.80.101). The Canadian Centre also says what it does not do: a VPN does not protect against a user clicking on a malicious link, and its security depends on how it is configured (ITSAP.80.101). The VPN is a well-guarded door, not protection for the device using it.

Remote desktop open to the internet

The Canadian Centre’s ransomware playbook names internet-exposed services, including the Remote Desktop Protocol (RDP), among attackers’ ways in: exploited vulnerabilities, mass password guessing (ITSM.00.099). It asks that users go through the organization’s VPN. The joint guide from CISA, the NSA and the FBI says it more directly: do not expose services such as remote desktop on the web, and close unused ports (#StopRansomware).

1. Update the VPN, quickly

A VPN faces the internet, which is why it is attacked. The Canadian Centre has published several alerts on active exploitation of VPN flaws, and asks for patches to be applied as quickly as possible (alert AL19-016). One of these flaws even allowed two-factor authentication to be bypassed: multifactor authentication does not replace updates. The NSA and CISA note that VPN flaws have been exploited sometimes less than 24 hours after being published, and recommend replacing a device its manufacturer no longer updates (NSA and CISA).

2. Multifactor authentication on every access

The Canadian Centre calls for multifactor authentication on VPN access, with phishing-resistant factors (ITSAP.80.101), and its ransomware playbook asks to turn it on at all access points (ITSM.00.099). Our article on mandatory MFA in Microsoft 365 explains what Microsoft already requires, and what is still up to you.

3. Give access only to what is needed

The Canadian Centre recommends restricting the ports and protocols the VPN allows (ITSAP.80.101) and applying the principle of least privilege to remote access too (ITSM.00.099). An employee who needs the accounting software does not need to see the whole network.

4. Keep a record

The Canadian Centre recommends logging VPN activity and reviewing it (ITSAP.80.101), and its ransomware playbook asks for timestamped logs that cannot be altered (ITSM.00.099). On the day of an incident, those logs say who got in, when, and from where. Our article on ransomware in the first hour shows what they are for on that day.

5. The device and the home network

The Canadian Centre recommends company-issued devices, because a personal device may not be up to date (ITSAP.10.016). At home, it advises changing the default Wi-Fi password, and points out that a router no longer updated is a risk (ITSAP.10.116).

In short

An up-to-date VPN, with multifactor authentication, giving access only to what is needed and keeping a record; no remote desktop opened directly to the internet; up-to-date devices. That is what MPJM’s monthly security review checks, month after month, in a written report.

Frequently asked questions

Is a VPN enough to protect remote access?

No: the Canadian Centre for Cyber Security points out that a VPN does not protect against a user clicking a malicious link, and that its security depends on its configuration.

Can remote desktop be left open to the internet?

The Canadian Centre names exposed services such as remote desktop among ransomware’s ways in and asks users to go through the VPN; CISA says not to expose them on the web.

Does a VPN need updating?

Yes, as quickly as possible: the Canadian Centre has published alerts on exploited VPN flaws, one of which bypassed two-factor authentication.

What now?

Not sure how your employees get into your network from outside, or what is open to the internet? Ask for MPJM’s free network analysis, offered to businesses with 10 or more workstations.

P.S. Sixteen questions, eight domains, a clear picture of your strengths and blind spots: start the assessment.