7 Threat Trends from the 2022 RSA Conference

Back at the start of the coronavirus pandemic, employees locked out of abruptly shuttered offices often had no choice but to use notoriously insecure RDP connections to access networks remotely.

These days, most channel pros have switched their clients over to safer alternatives like VPN, but that doesn’t mean RDP’s days as a threat vector are over. Though attackers are having less success using RDP to get into networks they’re having more success using it to move laterally within networks once they’re inside. 

In fact, according to Sophos researchers, while the percentage of external assaults involving RDP dropped from 32% in 2020 to 13% in 2021, the percentage of incidents involving internal use of RDP rose from 69% to 82% in the same time span.

What can you do in response? Not much, according to John Shier, a senior security advisor at Sophos. “It’s built into Windows,” he says. “You can’t remove it, and so even if you disable it, they just turn it back on.”

Multifactor authentication and internal RDP gateways can help, Shier continues, but only to a degree. “Sadly,” he sighs, “RDP is always going to be a problem.”