The Remote Desktop Protocol (RDP) is Microsoft’s protocol for connecting to the graphical desktop of a Windows computer over a network, by default on TCP port 3389.
How RDP works
RDP lets administrators and employees work on a remote computer as if they were sitting in front of it: the server sends the screen image, the client sends keyboard and mouse input. It is built into Windows and widely used for server administration, remote work and support. Modern versions encrypt traffic with TLS and support Network Level Authentication (NLA), which requires the user to log in before a full session is created.
Why RDP is a major attack vector
Hundreds of thousands of RDP servers are reachable directly from the internet, and many are protected only by a password. This makes RDP one of the most common initial attack vectors for ransomware:
- Brute force and password spraying – bots constantly try common passwords against exposed RDP; see brute force.
- Stolen credentials – initial access brokers sell working RDP logins on criminal forums.
- Vulnerabilities – BlueKeep (CVE-2019-0708) was a wormable pre-authentication remote code execution flaw in older Windows versions.
Inside networks, attackers also use RDP for lateral movement with stolen admin credentials, because RDP sessions look like normal administration.
How to secure RDP
- Never expose RDP directly to the internet; put it behind a VPN or an RD Gateway with MFA.
- Enable NLA, account lockout policies and strong unique passwords.
- Restrict which users and source addresses can connect, and disable RDP where it is not needed.
- Patch Windows promptly and monitor logs for many failed logins and unusual RDP connections.
