Securing RDP: gateway vs VPN vs Private Access
Overview
Exposed RDP is one of the top ransomware vectors. Present three patterns to clients with clear tradeoffs.
Option comparison
| Pattern | Pros | Cons |
|---|---|---|
| RD Gateway + MFA | Familiar; central access | Must patch and harden gateway |
| VPN then RDP | Network-level MFA at VPN | Split tunnel risk; client overhead |
| Zero Trust / Entra Private Access | Modern posture; granular | Newer; licensing and training |
Minimum standards
- No RDP directly on 3389 from internet without tunnel or gateway.
- Enforce NLA, strong cipher suites, and account lockout.
- Prefer restricted local logons; use PAW for admins on high-risk clients.
Monitoring
Alert on brute-force RDP; correlate with geo IP and impossible travel.
UX tip
Give users a single bookmark to gateway URL; reduce shadow IT remote tools.
Documentation
Architecture diagram, firewall rules, MFA dependency, and break-glass path stored in client KB.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...