About this question
I'm trying to figure out the risks of running RDP over the internet, using two windows 10 professional stations, and if a VPN is absolutely necessary to achieve good security.
From the information I found so far on the net, a leak was discovered in 2012 that allowed the creation of exploits to intercept an RDP session. I understand this leak was closed in the meantime and that you were always protected if you used Network Level Authentication (NLA).
Most other security issues seem to be focused on the client side, i.e. when connecting to an untrusted RDP session with the main purpose of stealing a user's credentials.
If we assume the following situation:
Windows 10 Professional used on host and client side
Host side with fixed IP, no DNS involved to establish connection
NLA used Strong passwords used, changed monthly, Administrator account not active Host machine contains confidential information Would you not feel comfortable enough? Where do you see the biggest risk as opposed to a connection over VPN? And is there a way to increase security of the RDP connection without resorting to VPN?
