Remote desktop connection, configuration and security

HI,

To be compliant with PCI, we need to review the way we have configured Remote Desktop Protocol. We need to be using Remote Desktop Connection, with HIGH encryption level. At my organization, people use RDC when:

* Admins and users are physically outside of the network: In which case, they have to VPN to the network and then only they can remote in to the intended machine.
* Admins and users are physically on the network: In which case, they can directly start a remote session with the server.

PCI requirement is not very clear about whether we need to have high encryption level for "on-network" type of connections or this requirement is only meant for organizations allowing RDP over internet?

If you PCI better, that's great, please share !

But from technical standpoint, I also want to compare the security aspect of using RDP over the internet and RDP over VPN. Can we say RDP over VPN is quite secure ? What measures can I take to secure RDC sessions.

Thanks !
pratz09Asked:
Who is Participating?
 
CoccoBillConnect With a Mentor Commented:
The only requirement for internal traffic is that all sensitive information such as authentication credentials need to be protected, encrypting other traffic is merely recommended. RDP protects the authentication credentials and provides some level of encryption so this should not be a problem.

RDP over VPN is as secure as anything over VPN. For external RDP access I would only allow it with High or FIPS-compliant encryption, and either TLS or network-level authentication to mitigate man-in-the-middle attacks. For external access one measure that would greatly improve the security would be to restrict the addresses connections can be made from in the VPN gateway/firewall, if that's possible.
0
 
pratz09Author Commented:
Thanks !
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.