Exposed remote desktop (RDP)
A remote access service to a workstation or server left open to the internet, long the leading entry point for ransomware and a knockout question in cyber underwriting applications.
The remote desktop protocol lets a user take control of a computer across a network. It is indispensable for system administration and remote work, but when exposed directly to the internet, without a secure gateway or multi-factor authentication, it becomes an entry point that automated tools scan constantly. Attackers get in by brute-forcing weak passwords, with stolen credentials bought from access brokers, or through vulnerabilities in the service itself. At the height of the ransomware wave, this vector topped the intrusion causes reported by response firms, especially among small and midsize companies that had opened access in the rush of the 2020 lockdowns. For the underwriter, an exposed remote desktop service is one of the rare risk factors that is both decisive and verifiable from outside, through a simple scan. Many insurers make it a ground for declining or an exclusion until access is placed behind a virtual private network with strong authentication.
In May 2019, the operating system vendor patched the BlueKeep vulnerability in the remote desktop service, exploitable without authentication and capable of spreading from machine to machine. An internet scan a few days later counted nearly one million exposed, vulnerable systems.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.