RDP security best practices start with one rule: keep it off the internet. Dr. Mike Saylor and Prasanna join me to explain why RDP gets called the Ransomware Deployment Protocol.

Every Windows machine you own shipped with this thing switched on. Nobody asked you. Nobody sent a manual. It's just running there, waiting for somebody to find it.

And they will find it. Mike walks through how initial access brokers operate, and it's a lot less impressive than you'd want it to be. Run a Shodan query, get back every exposed RDP service on the planet with IP addresses, device types, and country of origin. Cross-reference against leaked credentials. Package it up. Sell it. Mike says the recon that used to take real work now takes about 30 seconds with the AI tools kicking around the dark net.

Then there's the problem where credentials stop mattering at all. Default RDP traffic isn't encrypted on the internal network. Mike describes a routing table poisoning job his team ran years back where they grabbed an admin's keystrokes headed to a server. No login. Just sitting in the middle.

Mike calls RDP a dollar store hammer. Still a tool, still drives a nail, just not what you'd reach for if anybody gave you a budget. I call it a hack-me sign taped to your back. Prasanna spends the episode playing devil's advocate and swears he isn't pro-RDP, which is exactly what a pro-RDP guy would say.

The back half is all fixes you can go do this week:

Block the protocol AND the port. Do one without the other and attackers just move to a different port.

Check what's using 3389 before you kill it, because your database connection might be living there.

Turn on network level authentication so people prove who they are before a session starts.

Put a VPN or zero trust product in front of it. Mike points out enterprise-grade options run around six dollars a user now, so the no-budget argument doesn't hold up like it did.

Stand up a bastion host and make all RDP traffic go through it.

Use group policy and endpoint tooling to kill RDP where nobody needs it, so lateral movement gets harder after somebody's already inside.

Monitor at the endpoint, network, and firewall layers — and build the governance layer on top, so when something trips at 2am you already know whether it's allowed.

Mike wears a blue hat and a red hat and can't pick one. I have exactly one opinion on RDP and I'm not moving off it.

CHAPTERS:

00:00 Windows ships with a back door

01:26 Welcome and my Facebook Marketplace weekend

03:18 Why RDP means Ransomware Deployment Protocol

04:46 What RDP actually does

05:51 Blue hat, red hat: Mike's split opinion

06:11 Does RDP deserve its bad reputation?

08:10 On by default, and you can't fully kill it

09:30 The back door nobody locks

11:52 Does the cloud secure RDP for you?

14:12 Who scans for exposed RDP, and how Shodan works

17:10 Initial access brokers explained

18:36 Vulnerabilities that skip credentials entirely

19:08 Unencrypted traffic and stolen keystrokes

20:38 The never-on-the-internet rule

20:59 The network survival stack: VPN and zero trust

23:22 Block the port and the service

24:17 Stopping lateral movement once they're inside

25:25 Network level authentication

27:50 Port 3389: check before you block it

29:44 Bastion hosts

30:26 Monitoring, auditing, and governance

31:19 Blue, red, and purple hats

Read the blog post: https://www.backupwrapup.com/rdp-security-best-practices/

See what Mike and I are building: https://www.stopransomware.com

Get the book: https://www.oreilly.com/library/view/learning-ransomware-response/9781098169572/

Or on Amazon: https://www.amazon.com/Learning-Ransomware-Response-Recovery-Stopping/dp/1098169581