1

Due to new PCI compliance standards we are forced to implement two factor authentication for our RDP connections. We have a fairly small IT footprint with myself and 2 others that would be using RDP to access our servers. This is my first brush with 2FA and I’d like to draw on the experience of others.

What I’m looking for:

  • Seemless integration with the standard windows RDP (hopefully easy)
  • Low cost
  • Smart phone options so we don’t have to purchase or carry key-fobs

What I’ve been looking at:

Any comments or suggestions are welcome.

Thanks spicecrew!

6 Spice ups
2

Would logging into a TS gateway and then RDP from there be considered 2 form authentication?

1 Spice up
3

Have you considered setting up a CA infrastructure and requiring those as well as username/password? You could go as far as tying them to usernames as well as devices.

4

Keep in mind that anything software based is has inherent security risks with it. Because if it is in software it can be hacked or duplicated fairly easily. this is why hardware devices like key-fobs are more secure. But if software based meets you needs go for it.

Have you though about smart cards?

5

scott1196 wrote:

Would logging into a TS gateway and then RDP from there be considered 2 form authentication?

No, they need to be two different methods, two separate passwords unfortunately do not qualify.

2 Spice ups
6

Steve9603 wrote:

Have you considered setting up a CA infrastructure and requiring those as well as username/password? You could go as far as tying them to usernames as well as devices.

I like the idea, but I’d need to be able to login from anywhere, not just where I have the cert installed.

1 Spice up
7

molan wrote:

Keep in mind that anything software based is has inherent security risks with it. Because if it is in software it can be hacked or duplicated fairly easily. this is why hardware devices like key-fobs are more secure. But if software based meets you needs go for it.

Have you though about smart cards?

For our uses we really don’t feel we need 2FA, we are doing it only to be PCI compliant. We use a web-based CC system and so no cardholder data is stored on-site. Smart cards require a reader wherever you want to login from and that just won’t cut it for us.

1 Spice up
8

you could use a usb token like a gemalto to store your cert on plug it in and you put in a pin for the device and it allows access to the installed cert ,

1 Spice up
9

look at Secure envoys BYOT ( bring your own token ) solution http://www.securenvoy.com/products/softtoken/overview.shtm

2 Spice ups
10

Have a look at

might just solve all your authentication requirements.

11

I understand this is a dead discussion, however I just wonder what your final decision was Shawn, as my company finds itself in the exact situation you described.

Thanks

1 Spice up
12

We use Duo - it works.

1 Spice up
13

No discussion is truly dead, this is the internet after all :slight_smile:

I just ran across it looking for a solution. OP, what was the final decision Shawn9726?

@shawnstugard9871