Exercise 3: Why RDP Should Never Be Exposed Directly to the Internet — Possible Solution ==================================================================== WHAT THIS CHAPTER SAYS ------------------------------ Per this chapter's warn-box, "RDP has been a major, persistent attack target specifically because it's so often left directly internet- facing - credential-stuffing campaigns and real, serious exploits (BlueKeep among them) have targeted exposed RDP endpoints repeatedly." THE REAL-WORLD EVIDENCE CITED ------------------------------ Two specific pieces of evidence: credential-stuffing campaigns (attacks that try large numbers of leaked or guessed username/password combinations against exposed login endpoints), and BlueKeep, a named, serious real vulnerability that specifically targeted exposed RDP services. Naming a specific, real exploit rather than a generic "it could be attacked" statement is what makes the caution concrete rather than hypothetical. WHY EXPOSURE SPECIFICALLY IS THE PROBLEM ------------------------------ Both categories of attack rely on being able to reach the RDP service directly from the internet in the first place - credential stuffing needs a login endpoint to try against, and BlueKeep needed a directly reachable, vulnerable RDP service to exploit. Neither attack is possible if RDP is never reachable from the open internet to begin with. THE RECOMMENDED FIX, TYING BACK TO CHAPTER 3 ------------------------------ Per this chapter, "exactly the same principle from Chapter 3's own database example applies here: RDP should be reached through a VPN or a jump host, never opened directly to the internet just for convenience." The same reasoning that kept a database off the open internet (reachable only through a sanctioned tunnel) applies to RDP - removing direct internet exposure removes the precondition both named attack categories depend on. WHY THIS WORKS AS AN ANSWER ------------------------------ It states the chapter's own two named pieces of real-world evidence (credential stuffing, BlueKeep), explains why direct internet exposure specifically is the precondition both depend on, and connects the recommended fix back to the chapter's own explicit parallel with Chapter 3's database example.