The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Protect remote access by removing unnecessary entry points, putting phishing-resistant MFA and least-privilege policies at every remaining path, tightly governing remote-management tools and vendors, and monitoring for lateral movement. Do not expose RDP directly to the public internet. If an account, gateway, or remote-access server may be compromised, contain it under your incident-response plan rather than treating a VPN shutdown as a complete fix.
Ransomware affiliates are operators who obtain or use access supplied by a broader ransomware operation. Their initial foothold may come from exposed remote services, stolen credentials, weaknesses in a VPN or identity provider, or legitimate remote-monitoring software used outside its intended purpose. Once inside, they can move between hosts, take data, disable recovery systems, and deploy encryption. The controls below reduce both the chance of entry and the damage that follows; none guarantees prevention.
As an Amazon Associate I earn from qualifying purchases.
What remote-access routes do ransomware affiliates exploit?
Start with the assumption that every way to connect from outside the organization is an attack surface. The important question is not whether a product is marketed as secure, but whether its exposure, identity checks, device conditions, permissions, logging, and administration are appropriate for the resource being reached.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Internet-facing remote services: Public RDP, remote-access servers, VPN appliances, cloud administration consoles, and other gateways can be probed continuously. CISA, the FBI, NSA, and MS-ISAC state in their #StopRansomware Guide that, “Threat actors often gain initial access to a network through exposed and poorly secured remote services, and later traverse the network using the native Windows RDP client.”
- Compromised identities: Password reuse, phishing, infostealer malware, stale accounts, and overprivileged vendor credentials can turn one login into broad access.
- Remote-management and monitoring tools: RMM agents are legitimate software, but an attacker who obtains an operator account or abuses an installed agent can use the tool’s trusted privileges and communications.
- Third-party connections: Managed-service providers, contractors, and suppliers may have persistent accounts, shared credentials, or access that is wider than the work requires.
- Unmanaged devices: Personal or noncompliant endpoints may lack current patches, disk protection, security logging, or a trustworthy identity signal.
Map these routes before choosing a replacement architecture. A VPN, zero-trust gateway, secure service edge, or secure access service edge is not automatically safe by category. Misconfiguration, weak identity controls, excessive permissions, and poor visibility can recreate the same exposure behind a different product label.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 1: Find every way in
Build an inventory that a responder can use during an outage, not just a procurement list. CISA guidance recommends auditing networks for RDP and remote tools, disabling unused services and ports, and maintaining diagrams that include cloud and third-party connections.
Create an access-path register
For each connection, record the owner, business purpose, reachable resources, identity provider, authentication method, source networks, device requirements, administrator, logging destination, and date of the last review. Include paths that are easy to overlook:
- VPN concentrators, remote-access servers, and site-to-site tunnels.
- RDP, VNC, SSH, web-based remote desktops, and administrative jump hosts.
- Cloud consoles, SaaS administration portals, single sign-on (SSO), and emergency “break-glass” accounts.
- RMM agents, remote-support utilities, software-distribution systems, and scripting interfaces.
- MSP, contractor, supplier, and temporary project accounts.
- Remote access from personal, home, or otherwise unmanaged devices.
- Backup consoles, hypervisor managers, domain controllers, storage systems, and operational-technology networks.
Validate the inventory technically
Compare firewall and load-balancer rules with vulnerability-scanner results, endpoint software inventories, identity-provider applications, and DNS records. Look for listeners that are not in the register, agents installed outside the approved software list, and accounts that have not authenticated recently. Confirm whether a “disabled” service is actually unreachable from the internet and from untrusted internal segments.
Assign a decision to every route
Each entry should be marked remove, replace, restrict, or retain with explicit controls. Give an owner a deadline for unused paths. A route without an owner or current business purpose should not remain enabled merely because it might be useful later.
Should RDP be exposed to the internet?
Generally, no. Disable public RDP when it is not needed. CISA’s Disable Remote Desktop Protocol (RDP) countermeasure, created and modified March 14, 2025, treats disabling RDP as a practical eviction and prevention measure. If staff or administrators require RDP, make it reachable only through an approved secure path, such as a VPN that enforces MFA or a zero-trust remote-access gateway.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Safer RDP design
- Remove direct exposure. Delete internet-facing firewall and NAT rules for TCP and UDP RDP ports unless a documented exception has been approved. Do not rely on moving RDP to a different port as the primary defense.
- Place a controlled gateway in front. Require users to authenticate to the approved VPN or broker before the RDP host is reachable. Keep the gateway on a protected management segment and restrict which source networks can reach it.
- Require strong identity checks. Enforce MFA for the gateway and for privileged accounts. Where the platform supports it, use a phishing-resistant method rather than a one-time code delivered through a phishable channel.
- Limit destinations and users. Permit only named administrators or staff to reach specific hosts. Use separate administrative accounts and do not grant a general VPN user access to the server subnet.
- Harden the protocol. Apply current security updates, enforce account lockout or throttling, disable unused redirection features, and prevent unnecessary clipboard, drive, printer, or device mapping on administrative sessions.
- Log and review. Capture successful and failed logons, source address, destination host, account, session duration, and privilege changes. Alert on password spraying, impossible travel, unusual hours, and a new administrator logging in to many hosts.
Test the design from an untrusted network. A successful external scan should show no direct RDP listener; an approved user should reach only the gateway and then only the hosts assigned to that role.
Make identity the control point
A VPN authenticates a connection; it does not make the resulting account or network trustworthy. CISA’s LockBit advisory, updated June 4, 2025 and describing tactics identified through investigations through January 2025, recommends treating VPN access as untrusted and considering zero-trust principles. Apply policy at the resource and identity level instead of granting a broad internal position after one login.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Require MFA where compromise would matter
Require MFA for VPN, email, SSO, remote administration, and access to critical systems. CISA’s Require Multifactor Authentication guidance identifies hardware-based PKI and FIDO as examples of phishing-resistant authentication.
A FIDO2-compatible hardware security key can be appropriate for administrators and other high-impact users. Check compatibility with the organization’s identity provider, operating systems, browsers, and VPN before deployment. Keep at least one enrolled replacement or an approved recovery procedure, document how a lost key is revoked, and test recovery without falling back to an unprotected help-desk reset.
Separate and minimize privileges
- Give administrators distinct accounts for administration and ordinary work. Do not browse email or the web with a domain-administrator session.
- Grant access only to the systems and functions required for a role. Time-limit elevated rights when the platform permits it.
- Remove dormant, shared, and former-employee accounts promptly. Review vendor and contractor accounts at the end of each engagement.
- Prevent service accounts from interactive or unnecessary remote sign-in. Use noninteractive identities with narrowly scoped permissions where possible.
- Require a second approval for changes to identity providers, VPN configuration, backup systems, and security tooling.
A stolen password should not automatically provide access to every server, backup, or administrative console. Per-resource authorization, device checks, and session controls make the compromise of one identity less useful to an intruder.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Patch the gateways and internet-facing software
Remote-access infrastructure is both a security boundary and a high-value target. Patch VPN appliances, firewalls, remote desktops, identity components, edge operating systems, and public-facing applications according to risk, with emergency handling for vulnerabilities known to be exploited.
CISA’s LockBit advisory states a recommendation to patch vulnerable public-facing applications within 24 to 48 hours of disclosure. That interval is the advisory’s stated recommendation, not a universal service-level rule; organizations should use it as a trigger for an expedited, tested change process rather than wait for a normal maintenance window.
Make emergency patching workable
- Maintain supported versions and current configuration backups for each gateway.
- Subscribe to vendor and national vulnerability alerts and identify assets affected by a newly disclosed flaw.
- Prioritize known exploited vulnerabilities and systems that accept internet traffic or authenticate remote users.
- Test the update against identity, routing, MFA, and logging dependencies, then deploy through a documented change.
- Verify the version and exposed services after deployment. If a patch cannot be applied immediately, remove exposure, restrict source networks, or take the service offline while leadership accepts the operational impact.
Do not treat a compensating firewall rule as a permanent substitute for a supported, patched gateway.
Approve and monitor remote-access and RMM software
Legitimate remote-support software can be abused because it often has administrative reach and blends into normal operations. CISA’s Guide to Securing Remote Access Software recommends controlling these tools, auditing their use, and disabling unneeded protocols and ports.
Use a short allowlist
Maintain an inventory of approved products, versions, agents, tenants, and administrators. Block or remove unapproved remote-control software. Do not allow technicians to install a portable executable simply because it is convenient; require a ticket, an identified customer or host, and an approved access route.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Constrain operator permissions
- Use individual technician accounts rather than shared credentials.
- Require MFA for the RMM console and separate console administration from endpoint administration.
- Permit technicians to reach only assigned customers, sites, or host groups.
- Disable file transfer, scripting, shell access, and unattended control unless the job requires them.
- Set short session lifetimes and revoke sessions when a technician leaves or a vendor relationship ends.
- Put minimum security requirements, notification duties, logging retention, and incident cooperation in MSP and supplier contracts.
Review behavior, not only installation status
Send authentication and tool-execution logs to a central system. Investigate a new device or location, an unusual time, a rarely used account, a burst of connections, execution from a temporary directory, portable-tool use, or a technician account touching many unrelated hosts. Correlate RMM events with endpoint process creation, VPN authentication, and identity-provider changes. A known tool used in an abnormal sequence can be as important as an unknown binary.
Reduce lateral movement and ransomware blast radius
Initial access becomes a major incident when a user or gateway can reach too much. NIST’s current Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile, IR 8374 Rev. 1, dated June 2026, and the earlier NIST SP 800-46 Rev. 2 provide risk and remote-access context for these controls.
Segment by function and consequence
Separate user workstations, production servers, identity infrastructure, administration, backups, and operational technology according to actual business dependencies. Permit only required flows between segments. Keep backup management interfaces inaccessible from ordinary user and VPN networks, and prevent a workstation session from reaching domain controllers or hypervisor consoles unless the role explicitly requires it.
Use resource-level policies
Define who may reach which application, host, port, and administrative function, from which device conditions and source locations. Reevaluate these rules when systems move to the cloud or when a vendor changes. A network diagram that shows only subnets can hide an identity or SaaS dependency; document both network and application paths.
Watch for movement
Centralize VPN, RDP, identity, endpoint, firewall, DNS, and RMM logs. At minimum, retain enough detail to answer:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Which identity authenticated, from what source, at what time, and through which gateway?
- Which hosts did the session reach, and did it create a new account, service, scheduled task, or remote-management session?
- Did one account authenticate to an unusual number of hosts or cross a segment boundary?
- Were security tools, backups, shadow copies, or recovery credentials changed?
Alerting should be paired with an owner who can investigate. Logs that are never reviewed do not provide practical detection, and logs stored only on a compromised gateway may disappear with the intrusion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare remote-access architectures by control, not label
When evaluating a redesign, score each option against the same operational requirements. CISA and partners’ Guidance for Modern Approaches to Network Access Security, published June 18, 2024, encourages organizations to consider modern approaches while accounting for traditional VPN weaknesses and misconfiguration risk.
| Decision axis | Questions to answer | Stronger outcome |
|---|---|---|
| Exposure | Is a service directly reachable from the internet, or is access brokered through a restricted gateway? | No unnecessary public listeners; protected, monitored entry points. |
| Identity strength | Does the path accept a password alone, ordinary MFA, or phishing-resistant MFA? | Phishing-resistant MFA for privileged and high-impact access where supported. |
| Access scope | Does a successful login expose a network segment or only named resources? | Per-user, per-device, per-resource authorization. |
| Device posture | Can unmanaged or noncompliant devices connect? | Managed, supported, encrypted devices with current security controls, or a deliberately isolated exception. |
| Visibility | Are there only authentication records, or also endpoint, command, and network activity? | Correlated identity, gateway, endpoint, and network logs with retention and alert ownership. |
| Operational fit | Will the design work with the identity provider, legacy applications, vendors, and recovery process? | A tested path that responders can revoke and restore without undocumented dependencies. |
| Resilience | Can sessions be revoked, credentials rotated, logs preserved, and access recovered after an incident? | Documented emergency controls and tested restoration. |
The best architecture is the one the organization can configure, monitor, patch, and revoke consistently. A theoretically strong design that staff bypass with unsanctioned tools creates a new shadow access path.
Prepare for a compromised remote-access credential or gateway
Include remote access in the incident-response plan before an alert occurs. The objective is to stop continuing access and preserve evidence while avoiding an indiscriminate shutdown that destroys essential services or evidence.
Immediate containment decision
- Activate incident leadership. Assign one person to authorize access changes and another to preserve evidence. Record times and decisions.
- Identify the scope. Determine the accounts, gateways, hosts, vendors, sessions, and time window involved. Review VPN, RDP, SSO, endpoint, firewall, and RMM evidence.
- Revoke the path. Disable or suspend compromised accounts, invalidate active sessions and tokens, rotate exposed secrets, and remove unauthorized keys. Do not merely change a password while leaving a stolen session valid.
- Restrict the service. Consider disabling the VPN, remote-access servers, SSO, or affected public-facing assets when necessary. CISA’s ransomware guidance identifies these actions as possible containment measures; coordinate them with incident leadership and business owners.
- Contain reachable systems. Isolate affected endpoints and servers, block suspicious source addresses where useful, and restrict lateral protocols between segments. Preserve volatile and centralized logs before systems are rebuilt.
- Find persistence and impact. Look for new accounts, scheduled tasks, services, remote tools, changed MFA methods, modified firewall rules, backup deletion, data staging, and evidence of exfiltration.
- Restore deliberately. Reopen access only after the compromise and persistence paths are understood, affected credentials are replaced, gateways are patched, monitoring is active, and the restored route has been tested.
Do not assume that stopping encryption ends the intrusion. An affiliate may retain credentials, tokens, remote tools, or alternate gateways. Scope the investigation to identity, endpoint, network, cloud, and supplier systems that could provide continuing access.
A practical implementation checklist
- Complete and owner-assign an inventory of VPNs, RDP, remote desktops, RMM agents, cloud consoles, SSO, vendors, and personal-device access.
- Remove public RDP and close unused ports, protocols, accounts, agents, and firewall rules.
- Patch internet-facing gateways and applications; use an expedited process for known exploited vulnerabilities.
- Require MFA for VPN, email, SSO, privileged accounts, and critical systems; prefer phishing-resistant methods where compatible.
- Separate administrative accounts, remove stale identities, restrict service-account sign-in, and apply least privilege.
- Allowlist remote-support tools and require individual technician identities, scoped permissions, approvals, and session revocation.
- Segment users, servers, administration, backups, and operational technology; enforce resource-level access.
- Centralize and retain authentication, RDP, RMM, endpoint, firewall, and network-flow logs with alert ownership.
- Exercise the emergency procedure for disabling remote access, rotating credentials, preserving evidence, and restoring a clean path.
- Review the register and access rules after mergers, vendor changes, cloud migrations, major incidents, and at a defined recurring interval.
What this protection can and cannot do
These measures lower exposure, make stolen credentials less powerful, reduce reachable systems, and improve the chance of detecting abnormal activity. They do not guarantee that an affiliate cannot enter, and they do not replace tested offline or otherwise protected backups, endpoint security, data-protection planning, or an incident-response capability. The practical goal is to make remote access necessary, narrow, observable, revocable, and difficult to turn into organization-wide control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
