Rds infrastructure is the gateway to network
0 likes113 views
RDS infrastructure provides remote access to network resources and cloud servers, but is often neglected from a security perspective. It is critical to develop a secure RDS environment since it acts as the gateway to the entire infrastructure. Standard practices like using non-default ports, multi-factor authentication, firewalls, and monitoring with tools like OMS can help protect the network by restricting unauthorized access through RDS. Monitoring results showed multiple fake accounts and IPs attempting unauthorized access.
Rds infrastructure is the gateway to network
- 1. RDS infrastructure is the Gateway to network-Take it seriously. Suman B. Singh RDS (Remote Desktop Service) solutions is the most neglected bit in infrastructure design BUT it will be one of the sensitive component in upcomingcloud trend. "We just need RDS servers to install and run some business applications and must be accessible over internet to provide mobility."This is the very common practice that we come across.While world is adopting cloud then obviously no need to visit physical data centers to perform day to day activities so accessing servers remotelyis the onlyway to manage infrastructure. It becomes very important to developsecure RDSenvironment to access anycloud infrastructure because this is the gateway to complete infrastructure. Installing and configuring RDS role will allow user to access servers remotely but same time it opens backdoor to break into cloud infrastructure. Well-known ports like 3389 and easily traceable and one can use brute force to gain access to network. A secure RDS solution must be implemented to access servers remotelyto make sure networkis protected. Below mentioned steps can be taken as standard practice that can be used to protect infrastructure. 1. Use multitier infrastructureapproach,Enable NACL 2. Don’t use default RDP. Use random ports to provide access 3. Configure RDS Gateway and Azure application proxy to protect RDS Session Host servers’ identities 4. Use SSL 5. Implement multi-layerofsecurity (MFA/Firewalls/UDR) 6. Disable default users 7. Use App-Locker Results were surprisingwhen all cloud servers were monitored usingOMS suit.
- 2. Figure 1: OMS in action. Showing fake accounts attempted to access the network. Figure 2: Unauthorized Logon Attempts using 3389
- 3. Figure 3: IPs generating attacks Figure 4: Top Targeted Accounts