iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect remote access by removing unnecessary entry points, putting phishing-resistant MFA and least-privilege policies in front of every remaining connection, restricting remote tools and vendors, segmenting critical systems, and monitoring for lateral movement. Do not expose RDP directly to the internet. If an account, gateway, or remote-management tool may be compromised, contain that access under your incident-response plan rather than assuming that encryption is the only objective.
Ransomware affiliates commonly obtain an initial foothold through exposed remote services, stolen credentials, VPN weaknesses, or legitimate remote-monitoring software that has been abused. They can then move between hosts, steal data, disable recovery systems, and deploy ransomware. No single control guarantees prevention; the goal is to make access difficult to obtain, narrow what an authenticated user can reach, and make misuse visible quickly.
How ransomware affiliates use remote access
Ransomware groups often operate an affiliate model: one criminal operation may provide malware and infrastructure while partners find victims, steal data, or negotiate payment. The partner does not need a novel exploit if an organization leaves a remote service exposed or allows a broadly privileged account to authenticate from an unmanaged device.
Free tools Windows power users keep installed
One-click scans. No signup required.
The sequence is usually more important than the label attached to the criminal group:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Initial access: an exposed gateway, vulnerable edge device, stolen password, weak VPN configuration, or abused remote-management agent provides a foothold.
- Credential expansion: the intruder collects tokens, passwords, browser data, or additional accounts and looks for administrative paths.
- Lateral movement: native tools, including Windows Remote Desktop Protocol (RDP), connect the first host to file servers, domain controllers, backup systems, and other high-value assets.
- Impact and extortion: data is copied, recovery systems are disrupted, and ransomware is deployed where the operator has sufficient rights.
The joint CISA, FBI, NSA, and MS-ISAC #StopRansomware Guide (September 2023) states: “Threat actors often gain initial access to a network through exposed and poorly secured remote services, and later traverse the network using the native Windows RDP client.” Treat every remote connection as a potential path to other systems, not as an isolated convenience feature.
1. Find every way into the environment
You cannot protect a route that is missing from your inventory. Create one authoritative register for remote access and assign an owner, business purpose, data scope, and review date to every entry.
Inventory these access paths
- Internet-facing VPN concentrators, remote-access servers, secure gateways, and cloud access portals.
- RDP, SSH, VNC, web-based remote desktops, and other remote administration services.
- Single sign-on (SSO), identity-provider consoles, cloud-management consoles, and emergency administrator accounts.
- Vendor, managed-service-provider (MSP), contractor, and support accounts, including accounts that are enabled only for maintenance windows.
- Remote-monitoring and management (RMM) agents, unattended-support tools, scripts, and portable executables.
- Remote access from personal, unmanaged, or shared devices.
- Connections to operational technology, building systems, point-of-sale systems, backup infrastructure, and other environments that may not appear on the corporate network diagram.
Maintain diagrams that show third-party and cloud connections, trust boundaries, and the systems reachable after authentication. CISA’s guide recommends auditing for RDP and remote tools, disabling unused services and ports, and keeping current network diagrams that include external connections. Link each approved path to a named owner; an orphaned gateway or vendor account should be treated as unnecessary until someone justifies it.
2. Remove public exposure and constrain what remains
Keep RDP off the public internet
RDP should generally not be internet-facing. Disable it where it is not required. For systems that need RDP, make it reachable only through an approved secure path, such as a VPN protected by MFA or a zero-trust remote-access gateway. CISA’s Disable Remote Desktop Protocol (RDP), CM0025 countermeasure was created and modified March 14, 2025 and describes disabling unnecessary RDP and restricting required use.
At the gateway and host, restrict which source networks, user groups, devices, and time windows can connect. Do not rely on a hidden port, a changing port number, or an IP allowlist as a substitute for authentication. Enforce account lockout or equivalent rate limits, record successful and failed logins, and review whether RDP is being used outside its documented purpose.
Close unused protocols and ports
Remove old port-forwarding rules and firewall exceptions. Disable remote services that have no current owner. For a service that must remain, document its listener, permitted source, destination, authentication method, and logging destination. Recheck the rule after a network change; temporary access frequently becomes permanent.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Patch the exposed edge first
Prioritize VPN appliances, firewalls, remote-access servers, identity infrastructure, internet-facing applications, and remote endpoints. CISA’s LockBit advisory, updated June 4, 2025 and covering tactics identified through January 2025 investigations, recommends prioritizing known exploited vulnerabilities. That advisory specifically recommends patching vulnerable public-facing applications within 24 to 48 hours of disclosure; treat that interval as the advisory’s stated recommendation, then adapt it to your emergency-change and validation process.
After patching, invalidate sessions and rotate credentials when the vulnerability could have exposed authentication material. A patched appliance can still be compromised if an attacker already established persistence.
3. Make identity the control point
Require MFA on the routes attackers value
Require multifactor authentication for VPN, email, SSO, administrator accounts, and access to critical systems. Prefer phishing-resistant methods, such as FIDO-based authentication or hardware-backed public-key credentials, where the identity provider and VPN support them. CISA’s Require Multifactor Authentication guidance identifies FIDO and hardware-based PKI as examples.
A FIDO2-compatible hardware security key can be an appropriate category of second factor, but confirm support for your current identity provider, operating systems, browsers, VPN client, recovery workflows, and administrative consoles before purchasing. Issue at least one spare according to your organization’s policy, record ownership without storing private keys, and maintain a secure process for lost or damaged keys. If a system supports only push or one-time codes, use those rather than leaving the account password-only, while planning a migration to phishing-resistant MFA.
Separate privileged identities
- Give administrators distinct daily-use and administrative accounts.
- Remove stale, shared, and former-employee accounts promptly.
- Grant access only to the systems and functions required for the person’s role.
- Prevent service accounts from interactive or unnecessary remote sign-in.
- Use time-limited or approval-based elevation for sensitive tasks where practical.
- Require reauthentication for high-impact actions such as changing MFA, creating accounts, disabling security tools, or modifying backups.
MFA reduces the value of a stolen password, but it does not make a session trustworthy. A user who passes MFA should still be limited by device condition, location or risk signals, resource policy, and role.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Govern remote-access and RMM software
Build a small approved-tool allowlist
Maintain an inventory of every remote-support and RMM product, agent, service account, installer, and listening port. Record the owning team, vendor, tenant, approved use, permitted destinations, update process, and offboarding contact. Remove agents that cannot be attributed to a current contract or business need.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Permit approved tools only through approved access routes. Do not allow technicians to install an arbitrary portable executable simply because it is convenient. Application control, endpoint detection, DNS filtering, and firewall policy can enforce the allowlist at different layers; use more than one where the risk justifies it.
Review tool activity, not just installation
Collect authentication and execution logs from the identity provider, VPN or gateway, endpoints, and RMM platform. Investigate combinations such as:
- A technician account authenticating at an unusual time, location, or host.
- A new agent or portable executable appearing outside a change window.
- Remote-control activity followed by credential dumping, archive creation, or access to file shares.
- An RMM account authenticating to many hosts in a short period.
- Use of a tool or protocol that is absent from the approved inventory.
CISA’s Guide to Securing Remote Access Software recommends inventorying and securing remote tools, reviewing logs for suspicious use, and blocking unneeded protocols and ports.
Control vendors and MSPs
Give each supplier an individual account rather than a shared administrator credential. Limit the account to named systems, require MFA, use approval or just-in-time access for sensitive work, and disable it when the contract or maintenance window ends. Put logging, notification, vulnerability handling, incident cooperation, and evidence preservation requirements in the contract. Your team should be able to revoke the supplier’s sessions and credentials without waiting for the supplier to respond.
5. Compare remote-access architectures by control, not by label
VPN, zero-trust network access (ZTNA), secure service edge (SSE), and secure access service edge (SASE) are architecture categories, not automatic security outcomes. Configuration, identity assurance, endpoint condition, resource policy, logging, and administration determine protection. CISA and partners’ Guidance for Modern Approaches to Network Access Security (June 18, 2024) encourages organizations to evaluate modern approaches while accounting for traditional VPN weaknesses and misconfiguration risk.
| Decision axis | Higher-risk pattern | Stronger target state |
|---|---|---|
| Exposure | Directly exposed remote service or broad port-forwarding | Restricted gateway or brokered access with no unnecessary public listener |
| Identity strength | Password-only authentication | MFA, preferably phishing-resistant, with reauthentication for sensitive actions |
| Access scope | Full network access after VPN login | Per-user, per-device, and per-resource policy |
| Device posture | Unmanaged or unknown endpoint | Managed, encrypted, patched, and compliant endpoint, or a tightly isolated exception |
| Visibility | Authentication records only | Correlated identity, endpoint, tool-execution, and network activity |
| Operational fit | Architecture that cannot reach legacy systems or support vendors safely | Documented integration with identity, legacy applications, suppliers, and recovery procedures |
| Resilience and administration | No reliable session revocation, credential rotation, or log retention | Rapid revocation, rotation, preserved logs, tested break-glass access, and recoverable configuration |
NIST’s SP 800-46 Rev. 2 (2016) remains a useful general telework, remote-access, and BYOD baseline, but it should not be the sole source for current implementation decisions. NIST’s Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile, IR 8374 Rev. 1 (June 2026) provides a current ransomware-risk context.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Reduce the blast radius with segmentation
Separate user workstations, production servers, administrative systems, backups, and operational technology according to business need. Use firewall rules and identity-aware policy to allow only required flows. A remote user who needs one application should not receive unrestricted reachability to every server subnet.
Recommended Free Tools
Protect the administrative plane separately. Management interfaces, domain controllers, virtualization consoles, backup controllers, and security systems should be reachable only from designated administrator workstations or management networks. Keep backup credentials and recovery infrastructure outside the ordinary path used by staff and vendors, and test whether a compromised workstation can reach or alter them.
Segmentation is not a one-time diagram. Validate it with rule reviews, vulnerability scans, configuration checks, and controlled access tests. Remove exceptions when the project or vendor engagement ends.
7. Monitor the evidence that shows movement
Forward and retain logs long enough to investigate the organization’s normal incident window. At minimum, correlate:
- VPN, gateway, RDP, SSH, and SSO authentication successes and failures.
- MFA enrollment, reset, bypass, and recovery events.
- New accounts, group membership changes, privilege elevation, and policy changes.
- Endpoint process creation, remote-service use, PowerShell or command-shell activity, and RMM execution.
- Host-to-host connections, unusual SMB or administrative-share access, and connections to domain controllers or backup systems.
- Data staging, large outbound transfers, archive creation, and attempts to disable security or recovery controls.
Useful detections combine identity and network context. For example, a normal technician login to one assigned server is different from the same account authenticating to dozens of hosts, creating a new administrator, and accessing backup infrastructure. Alert on the sequence, not merely on a single failed login.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Prepare a remote-access containment decision
Include remote access explicitly in the incident-response plan and rehearse the decision with IT, security, operations, legal, and business owners. The objective is to stop continuing access while preserving evidence and maintaining essential services where possible.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
When compromise is suspected
- Declare and scope the event: identify the suspected account, endpoint, gateway, RMM tenant, vendor, time range, and systems contacted.
- Preserve evidence: retain identity, VPN, RDP, endpoint, firewall, and tool-execution logs before routine retention deletes them. Capture relevant system state under the response plan.
- Revoke access: disable or reset compromised accounts, revoke active sessions and tokens, rotate exposed secrets, and remove unauthorized keys or agents.
- Contain the route: consider temporarily disabling the affected VPN, remote-access server, SSO path, RMM tenant, or public-facing asset. CISA’s ransomware guidance identifies disabling VPN, remote access servers, SSO, and other exposed assets as possible containment actions.
- Limit spread: isolate affected hosts and block suspicious east-west connections while protecting evidence and critical operations.
- Restore deliberately: return access only after persistence paths, unauthorized accounts, vulnerable services, and credential exposure have been addressed. Use fresh credentials and heightened monitoring during re-enablement.
Do not indiscriminately shut down every connection without coordinating with incident leadership. An unplanned outage can interrupt safety, clinical, manufacturing, or recovery functions and may destroy useful evidence. The response plan should define who can authorize emergency isolation and what minimum services must remain available.
A practical implementation sequence
First 24 hours: remove obvious exposure
- Search external attack-surface data, firewall rules, cloud security groups, and asset inventories for public RDP and other unnecessary remote services.
- Disable unused listeners, port forwards, accounts, and RMM agents.
- Confirm MFA is enforced for VPN, email, SSO, and privileged accounts; identify password-only exceptions.
- Check for critical patches on public-facing VPN, firewall, remote-access, and identity systems.
First 30 days: establish ownership and policy
- Complete the remote-access register and network diagrams, including vendors and cloud services.
- Publish an approved remote-tool allowlist and an exception process with an expiration date.
- Separate administrator identities, remove stale accounts, and restrict service-account sign-in.
- Centralize VPN, RDP, identity, endpoint, and RMM logs and define alerts for unusual access and lateral movement.
- Document emergency revocation and gateway-shutdown procedures and test them with system owners.
Ongoing: test the assumptions
- Review exposure and firewall rules after every major network or supplier change.
- Run access reviews for vendors, MSPs, privileged users, and service accounts on a defined schedule.
- Exercise segmentation and restore procedures; verify that backup systems remain isolated from ordinary administrative paths.
- Test lost-key, lost-device, identity-provider outage, and compromised-gateway scenarios.
- Track exceptions until they are removed, not merely accepted indefinitely.
Common mistakes and how to correct them
“The VPN means the user is trusted”
A VPN authenticates a connection; it does not establish that the account, device, session, or destination is safe. Replace broad network access with resource-level policy, device checks, least privilege, and monitoring. CISA’s LockBit advisory specifically warns that VPN access should not be considered a trusted network zone and recommends considering zero trust.
“MFA is enabled, so phishing is solved”
Push fatigue, session theft, recovery fraud, and poorly protected administrator accounts can still undermine MFA. Prefer phishing-resistant methods, protect recovery channels, require reauthentication for sensitive changes, and alert on unusual MFA enrollment or reset activity.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →“We can allow any support tool temporarily”
Temporary tools become persistent blind spots when agents, accounts, and firewall rules are not removed. Use an allowlist, an owner, an expiration date, and logs that show which technician used the tool on which host.
“We only need to monitor encryption events”
By the time files are encrypted, an intruder may have spent days stealing credentials and data. Detect the earlier stages: unusual remote authentication, privilege changes, host-to-host scanning, mass share access, and attempts to reach backups.
Quick Recap
Remote-access protection checklist
- There is no unnecessary RDP exposure on the public internet.
- Every VPN, gateway, remote desktop, RMM agent, vendor account, and cloud console has an owner and business purpose.
- Public-facing remote-access and identity systems receive emergency patch prioritization, including attention to known exploited vulnerabilities.
- MFA protects VPN, email, SSO, critical systems, and privileged accounts; phishing-resistant methods are used where supported.
- Administrator and service identities are separated from ordinary user accounts and cannot perform unnecessary interactive sign-in.
- Approved remote tools are allowlisted, logged, restricted by route and destination, and removed when no longer needed.
- User, server, administrative, backup, and operational networks are segmented and tested.
- VPN, RDP, identity, endpoint, RMM, and network logs are correlated and retained for investigation.
- The incident-response plan covers credential revocation, session termination, gateway isolation, evidence preservation, and safe restoration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
