We have become accustomed to technology changing very quickly, but the onset of the epidemic was so surprising that even the otherwise flexible IT industry was unable to respond adequately. The gradual increase in the share of people working from home, employees taking sick days, flexible working hours – all of this is technologically manageable. But a situation in which most of a company ends up working from home became, in essence, a “disruptive” event for IT administrators or external IT service providers.
Corporate networks suddenly changed their topology entirely, data began flowing through unsecured connections and from unsecured devices, and many users suddenly lost access to all the information they needed that was stored on the corporate network. On top of all this, IT administrators lost comprehensive access to corporate user computers, and in the event of failures or malfunctions, it is now very difficult to gain any access other than remote access.
Remote Assistance
Windows computers enable two distinct types of remote connections based on RDP (remote desktop protocol) – remote desktop and remote assistance. Both connections are similar, and IT administrators use both methods to establish remote connections, but the motivations for their use and security requirements differ. IT administrators use remote assistance mainly for technical support. The PC user invites a technician to connect remotely so they can check the functioning of the user's computer and make changes or resolve problems. Without an invitation and its acceptance, the technician cannot log in to the remote machine.
If the computer settings allow it, the remote user enables their computer to be shared with the technician, who can then access their files, open them, and enter new data using their keyboard and mouse. This feature is extremely useful, especially in cases where an administrator has to resolve issues remotely that involve checking registries or scanning the computer. With remote assistance, both the user and the administrator see the same screen and are collaborating participants in the process.
Remote Desktop
With a standard Windows remote desktop connection, by contrast, the screen on the user's computer is locked as soon as the connection is established. This means that visual output is visible only on the remotely connected computer. Remote desktop enables the remote worker to gain full control of the computer regardless of the location from which it is accessed.
Although everything is displayed on the remote machine, all computing tasks are performed by the controlled computer. The remote worker sends input using their keyboard and mouse and receives visual or audio output in return. So, for example, when someone connects remotely to another computer in this way, they can save files to its hard drive. However, if they also want to have them available on their own computer's drive, they must transfer them before ending the connection.
Rather than for technical support, remote desktop connections are used to increase employee productivity, as they enable their computer to be connected from anywhere to another computer at the workplace. With certain configuration settings, they can also connect via the internet entirely outside the corporate network, for example from a home office. A typical example is access to information stored on one specific computer in the office to which users do not have physical access. Remote access is therefore the best available solution.
Security of remote connections
Regardless of whether we connect using remote assistance or remote desktop, security is an important factor. Establishing a remote connection creates a number of potential vulnerabilities that can threaten both connected computers and, consequently, the entire corporate network. The computer we connect to remotely is only as secure as the connection itself.
Both mentioned types of remote connection can become the target of a cyberattack, although they differ in certain respects. In the case of remote assistance, there is always someone on the other end of the connection. In technical support, it is assumed that they will not expose the user to cyber risks but rather protect them better. The user must first invite the remote worker to connect and can monitor them throughout the session.
Remote desktop does not have this type of control, and today it is often used by employees in a way that can lead to dangerous situations. This is why, for example, we have recently seen increased corporate interest in VPN solutions, which make it possible to encrypt the connection and ensure its security. It should be kept in mind that if hackers obtain the IP address of a computer capable of establishing remote connections, all they then need to do is somehow obtain login credentials. It is therefore also important to establish access management rules so that weak user passwords do not increase the risk of an attack.
Requirements for specialized solutions
Specialized solutions exist for managing remote access; SolarWinds Take Control, for example, is popular with managed service providers, and TeamViewer is also well known. Quality remote access management solutions include both basic and advanced security features:
● Elliptic Curve Diffie-Hellman (ECDH) scheme enabling secure sharing between two endpoints
● Ability to define IP addresses with access to the given tool
● Advanced Encryption Standard (AES) 256 for data in transit and at rest
● Multi-layer authentication
● Establishing secure sessions
● Automatic clipboard clearing after the session ends
● Prevention of disconnection due to auto-sleep and auto-lock modes or inactivity
Remote access management is one of the security areas that has rapidly gained importance as a result of the coronavirus. It is now increasingly offered by managed service providers, who are responding in this way to their customers' need to establish secure remote access.
Štěpán Bínek
The article was published in IT Systems magazine 7-8/2020
Article author: ZEBR.ai editorial team
