What are best practices for implementing Remote Desktop within a corporation?

Question

After the recent critical vulnerability: 'MS12-020: Vulnerabilities in Remote Desktop could allow remote code execution' I have been looking for a hardening checklist or in the scenario that I am an admin at an organization which allows access by Remote Desktop, what would be reasons to disable it or how to implement it securely, apart from Transport Layer security?

Answer 1

Defense-in-depth, patching policy, audit lots, and the standard security spiel are a good starting point. The risk isn't that there was a critical vulnerability as much as it is having mechanisms to prevent or detect unauthorized access. There are vulnerabilities that are known and exploited well before a tracking code (MS, CVE, BugTraq) are assigned.

The Center for Internet Security publishes hardening checklists for various devices. There are likely other organizations that publish similar checklists too.

You can easily disable RDP, but that may not necessarily increase your security posture (say if you're running a vulnerable/unpatched version of IIS with a publicly available exploit package). Protecting against 0day is a bit tougher, but there are ways to detect intrusion and prevent data exfiltration.

Answer 2

I think you have to define before properly each entity in your directory. Then you can apply appropriate policy on each of them. Company structure is the main key of a good IT infrastructure.