Why You Should Segment RDP & SSH – Source: securityboulevard.com

Securing remote access pathways often feels like an endless battle against evolving threats. Attackers continually search for exposed protocols, especially those that provide direct or near-direct access to critical systems. Remote Desktop Protocol (RDP) and Secure Shell (SSH) stand out as prime targets. When either protocol is left unprotected or poorly segmented, it can become the key to unlock a goldmine of lateral movement possibilities within a network.  

Securing RDP and SSH traffic with microsegmentation has emerged as a critical step toward stronger network defenses, as emphasized by frameworks from the Center for Internet Security (CIS) and the National Institute of Standards and Technology (NIST). Focusing microsegmentation projects on these high-risk, high-use protocols can rapidly shrink your attack surface and improve your company’s security posture. 

RDP and SSH Are High-Value Targets 

Adversaries regularly exploit RDP and SSH in brute-force attempts and credential-stealing campaigns. Although SSH is generally more secure than many older protocols, it is still frequently misconfigured, overused across multiple systems, or left without proper logging. According to a Coveware Q1-2025 ransomware report, RDP remains a common tactic by threat actors for lateral movement to jump from host to host.   

Similarly, IBM’s X-Force Threat Intelligence Index emphasizes how stolen credentials (including SSH) frequently fuel advanced persistent threat (APT) operations seeking unobstructed routes to critical systems. By compromising SSH credentials or keys, attackers can slip inside an environment and establish persistence or pivot laterally. Securing these protocols through microsegmentation helps keep attackers contained, even if they succeed in an initial intrusion. 

Securing RDP and SSH 

RDP and SSH are often the first protocols security teams lock down, and for good reason—many organizations still have dozens or even hundreds of servers exposed to remote admin access. Even with VPNs or cloud gateways in place, a misconfigured or poorly segmented network can give adversaries a foothold. 

That’s where microsegmentation comes in. By dividing environments into tightly controlled zones and enforcing strict communication policies, aligned with zero trust principles,you can restrict visibility and access to RDP and SSH ports. Paired with strong authentication, microsegmentation dramatically reduces the attack surface, blocks brute-force and scanning attempts, and prevents lateral movement, even if a remote device is compromised.  

Quick Microsegmentation Wins

Segmenting RDP and SSH is an effective starting point for microsegmentation, offering quick wins in security. Rather than attempting to segment every server and application at once, many experts recommend targeting the most commonly exploited protocols first. RDP and SSH, with their easily identifiable ports (3389 for RDP and 22 for SSH), provide a straightforward way to group assets based on their need for remote access. By applying policies that block unauthorized communication attempts, administrators can quickly enhance security. 

By first ring-fencing RDP and SSH sessions, you can yield swift security gains with relatively low implementation complexity. Firewalls and segmentation gateways can be configured to allow RDP and SSH traffic only from specific IP addresses, security zones, or user identity groups. This ensures that even if credentials become compromised, the malicious actor cannot move laterally from one server to another. 

Beginning a microsegmentation project with RDP and SSH offers a straightforward way to see the value of your segmentation platform while gaining tighter control over one of the most commonly exploited entry points. Once complete, it serves as a stepping stone for broader segmentation across databases, application tiers, and other critical systems. 

Aligns with Security Frameworks and Compliance Goals 

Microsegmentation aligns closely with leading security frameworks and compliance mandates by enforcing precise control over high-risk services like RDP and SSH. The CIS Controls, particularly CIS Control 12 on network infrastructure management, advocate for a phased segmentation strategy that restricts access based on business necessity—an approach that naturally prioritizes locking down remote administrative protocols. A Microsoft 2022 Digital Defense Report reinforces this urgency, identifying remote services such as RDP as frequent entry points for human-operated ransomware attacks. Neglecting to secure these pathways is like leaving the front door open, and once inside, attackers can move laterally, escalate privileges, and compromise critical assets. 

In addition to strengthening defenses, controlling RDP and SSH traffic significantly simplifies compliance with standards like PCI DSS, HIPAA, and GDPR, all of which require strict access controls and clear separation between administrative and user traffic. Microsegmentation also provides the granular visibility needed to enforce and prove these boundaries, making it easier to demonstrate that only authorized users can reach sensitive systems. Without it, organizations often face gaps in audit readiness and struggle to verify that critical services are properly isolated. 

Supports Zero Trust Frameworks 

The frequency of breaches involving RDP and SSH underscores the wisdom of prioritizing these protocols in any segmentation or zero trust strategy. Organizations that diligently control RDP and SSH traffic also find it easier to adopt zero trust models. A zero trust framework requires explicit permission for every connection, and it continuously evaluates risk based on context. Microsegmentation is integral to zero trust because it enforces smaller, more manageable trust boundaries. By narrowing the focus  on RDP and SSH segmentation first, you can reduce the complexity of zero trust pilot projects and demonstrate clear value in preventing unauthorized remote logins. 

Security teams can establish a strong use case for microsegmentation that scales upward to more sophisticated workloads with minimal friction. Organizations that follow this roadmap enjoy greater peace of mind, fewer successful intrusions, and a network architecture that remains resilient in the face of constant cyber threats. 

The 12Port Horizon platform simplifies microsegmentation by providing network traffic visualization, automated policy enforcement and labeling, and seamless integration with Active Directory, Entra ID, VMware, AWS, and other enterprise environments. Its agentless design enables fast deployment and comprehensive protection across physical, virtual, and cloud environments. With cost-effective pricing, 12Port makes it easy to get started segmenting RDP & SSH! 

The post Why You Should Segment RDP & SSH appeared first on 12Port.

*** This is a Security Bloggers Network syndicated blog from 12Port authored by Peter Senescu. Read the original post at: https://www.12port.com/blog/why-you-should-segment-rdp-ssh/