Remote access is where convenience and risk meet most directly: every way you let your people reach the office from outside is, by definition, a way in — and attackers scan the entire internet for those ways daily, no exaggeration. The good news is that secure remote access isn’t exotic. It’s a short list of right ways, one famous wrong way, and a couple of rules that do most of the work.
The famous wrong way: RDP open to the internet
Remote Desktop is a fine tool — inside a network. Exposed directly to the internet, it’s the single most reliable way small businesses get breached: automated scanners find the open port within hours, and then it’s password-guessing at machine speed, around the clock, until something gives. Ransomware crews’ initial-access playbook starts here so often that some cyber insurers scan applicants for exposed RDP and decline the ones they find, no conversation.
If anyone reaches a company machine today by typing an address into Remote Desktop from home without a VPN in between, close it this week. Everything else in this article is secondary.
The right ways, in order of how often they fit
A properly configured VPN. The traditional answer, still a good one: an encrypted tunnel into the network, with the firewall as the only listener. “Properly configured” carries weight — MFA on every connection (a password-only VPN just relocates the RDP problem), the firewall’s own firmware kept patched (VPN appliance vulnerabilities are actively hunted, and an unpatched gateway is a front door with a broken lock), and access granted per person, disabled the day they leave.
Cloud-first, no tunnel needed. If your files and apps live in Microsoft 365 or other cloud services, much of the “remote access problem” dissolves — people sign in to the services directly, and the security question moves to identity: strong MFA, sensible sign-in policies, and company-appropriate device rules. For many businesses, the honest modern answer is that the VPN exists only for the two legacy systems that still need it.
Zero-trust / remote gateway tools. The newer generation brokers each connection through an identity check instead of extending the whole network to the laptop — nothing listens on the open internet, and each person reaches only what they’re entitled to. Worth it especially when the old model’s weakness bites: a VPN puts the user’s device on your network, home-network germs and all. (The zero-trust idea, minus the buzzwords.)
The rules that do most of the work
- MFA on every remote path, zero exceptions. Most remote-access breaches are just stolen passwords; MFA converts them from catastrophe to log entry. Insurers ask about exactly this.
- Company access from managed devices. The family PC with three browser toolbars is not a trustworthy origin for your accounting system. Company laptops — or at minimum, enforced device standards.
- Least access, not whole-network access. The bookkeeper needs the accounting system, not everything with an IP address. Segmented access limits what any one compromised login can reach — same principle as the internal network.
- Offboarding includes remote paths, same day. VPN profiles, remote gateways, saved credentials — the checklist covers them by name, because remote access is the piece that lingers.
The access nobody audits: vendors
Software vendors, equipment suppliers, and support companies love standing remote connections into their systems — and every one is a door with someone else’s key. The rules for vendor access are stricter, not looser: enabled when needed and disabled after, never a shared always-on account, logged so you can see when it was used, and inventoried — most businesses can’t list their vendor connections, which means nobody’s watching them. Some of the most damaging breaches on record came through a vendor’s forgotten access; your size doesn’t exempt you from the pattern, it just shrinks the headline.
The bottom line
Secure remote access comes down to one principle: no direct doors, identity checked hard at every entry, and each login limited to what it needs. Close exposed RDP, put MFA on whatever remains, prefer per-app access over whole-network tunnels, and audit the vendor connections nobody remembers. Do that, and remote work stops being your riskiest surface and becomes what it should be — a place your team works from, not a place attackers get in. For teams that cross a state line every day, the two-state version of this problem has a few extra wrinkles worth knowing.