RDP

What is RDP?

RDP (Remote Desktop Protocol) is a Microsoft protocol that lets a user operate a graphical Windows session on another computer over the network, as if sitting in front of it. The remote computer’s screen output travels to the user, while keyboard and mouse input travel the other way. RDP is built into Windows, which makes it the default tool for administering servers, engineering stations and HMI/SCADA workstations. That same ubiquity also makes RDP one of the most abused entry points in ransomware attacks.

🔧 How does RDP work?

RDP arrived in 1998 with Windows NT 4.0 Terminal Server Edition and builds on the ITU-T T.120 family of multipoint communication standards. The protocol uses virtual channels: a single connection carries separate data streams, up to a theoretical 64,000 channels.

• Client - Remote Desktop Connection (mstsc.exe), the Windows App, or clients for macOS, iOS, Android and Linux (such as FreeRDP)
• Host - the Remote Desktop Services service listens on port 3389 by default, over TCP and, since RDP 8.0 (Windows 8 / Server 2012), also over UDP for better performance on slow or lossy links
• Display - the host sends drawing orders and compressed image fragments; only the parts of the screen that change are transmitted
• Input - keystrokes and mouse movements travel from client to host
• Redirection - virtual channels can also pass through the clipboard, local drives, printers, audio, smart cards and USB devices

Windows Pro, Enterprise, Education and Windows Server can act as an RDP host; Windows Home can only be a client. By default, members of the Administrators group and the local Remote Desktop Users group may sign in.

🏭 Where does RDP sit in the OSI or Purdue model?

In the OSI model, RDP is an application-layer protocol running over TCP or UDP, encrypted with TLS. In an OT network structured along the Purdue Model, RDP appears at several levels:

The guiding principle is that RDP traffic never crosses a zone boundary without an intermediate hop. This matches the zones-and-conduits model of IEC 62443.

🔐 How secure is RDP?

Modern RDP versions encrypt with TLS by default and support Network Level Authentication (NLA), introduced with RDP 6.0 in Windows Vista. With NLA, the user authenticates through CredSSP before a full session is built, which makes attacks without valid credentials much harder. Even so, RDP remains a popular security target:

BlueKeep (May 2019) was a pre-authentication vulnerability in Remote Desktop Services on Windows XP through Windows 7 and Server 2008 R2. Microsoft called it wormable and even released patches for the unsupported Windows XP and Server 2003. NLA offered partial protection, because an attacker then needed valid credentials first. In OT especially, such old Windows versions still regularly run on HMIs and engineering stations.

MITRE ATT&CK lists RDP as technique T1021.001 under lateral movement. In their ransomware guide, CISA and the FBI name exposed remote desktop services as one of the most common initial access routes and advise never exposing RDP directly to the internet.

🧭 How do you secure RDP step by step in an OT environment?

1. Take inventory - identify every system with RDP enabled, including temporary supplier connections. Disable RDP wherever it is not needed.
2. Close it off from the internet - no port forwarding of port 3389. Changing the port is not a security measure; scanners find RDP on any port.
3. Centralise access - route all sessions through a jump server or bastion host in the IDMZ, reachable through a VPN or RD Gateway (RDP over HTTPS on port 443).
4. Enforce strong authentication - mandatory NLA, MFA at the entry point and account lockout. Since Windows 11 22H2, new installations lock an account for 10 minutes after 10 failed attempts by default.
5. Limit privileges - keep the Remote Desktop Users group small, use personal rather than shared accounts, and manage administrator accounts with PAM.
6. Harden the session - disable clipboard and drive redirection, set time-outs for idle and disconnected sessions, and use Restricted Admin mode for helpdesk sessions to potentially compromised systems.
7. Log and monitor - forward sign-in events (Windows event 4624 with logon type 10, and 4625 for failed attempts) to the SIEM and record supplier sessions.
8. Patch or compensate - track Known Exploited Vulnerabilities for RDP flaws. If an HMI cannot be patched, shield it with a firewall that only admits the jump server.

For Dutch organisations that fall under the Cybersecurity Act (the Dutch transposition of NIS2), controlled remote access is part of the appropriate measures required by the duty of care. The same applies to remote maintenance by suppliers, a classic weak spot in OT.

🔄 What are the alternatives to RDP?

The much-discussed incident at the Oldsmar water treatment plant (Florida, 2021) involved TeamViewer rather than RDP, with a shared password on an outdated Windows 7 PC. Whether it was a real attack was later called into question, but the lesson stands: every remote desktop tool demands the same discipline.

❓ Frequently asked questions

Which port does RDP use?

RDP listens on port 3389 by default, over TCP and, since RDP 8.0, also over UDP. An RD Gateway wraps RDP traffic in HTTPS on port 443. Changing the default port barely helps, because scanners recognise RDP on other ports too.

Is RDP secure enough for use in OT?

RDP is secure enough in OT when it is only used internally, behind a jump server with MFA, with Network Level Authentication and current patches. RDP ports reachable directly from the internet, by contrast, are one of the main entry routes for ransomware. The security therefore lies mainly in the architecture around RDP.

What is Network Level Authentication in RDP?

Network Level Authentication (NLA) is an RDP feature in which the user signs in before the host builds a full session. This reduces the resources an attack can consume on the host and means vulnerabilities such as BlueKeep can only be exploited with valid credentials. Microsoft recommends always keeping NLA enabled.

What was BlueKeep?

BlueKeep (CVE-2019-0708) was a critical 2019 vulnerability in Remote Desktop Services on older Windows versions, from Windows XP through Windows 7 and Server 2008 R2. An attacker could execute code without signing in, so the flaw could spread like a worm. Microsoft therefore also released patches for unsupported systems.

Can I use RDP on Windows Home?

Windows Home can only connect to other computers as an RDP client, not act as an RDP host itself. Hosting requires Windows Pro, Enterprise, Education or Windows Server. In industrial environments, HMIs and engineering stations therefore almost always run Pro, Enterprise or IoT editions.

How do I detect RDP abuse in my logs?

RDP abuse shows up as sign-in events with logon type 10 (event 4624) at unexpected times or from unknown sources, and as series of failed attempts (event 4625). Forward these events to a SIEM and compare them with planned maintenance windows. Sessions that do not pass through the jump server deserve extra attention.

📌 In summary

RDP is Microsoft’s standard protocol for graphical remote administration of Windows systems, which makes it both indispensable and a frequently used attack route. In OT environments, RDP should only run internally, through a jump server in the IDMZ with MFA, Network Level Authentication, limited privileges, session logging and timely patching, in line with IEC 62443 and the Cybersecurity Act.