VPN and remote access: typical office holes
A remote desktop exposed to the internet is more dangerous than a forgotten plugin. People just do not count it as part of the site.
The site may get a review while the office door stays as it is: RDP or a similar service faces outward, the password is shared, a VPN exists "for the checkbox" and nobody uses it. An attacker does not care how tidy the storefront is. They need an entrance from which files and mail are visible.
What almost always turns up
- Remote desktop is reachable from the internet directly, with no VPN and no second factor.
- One account for everyone, including the contractor who set up the network.
- A VPN with no revocation: a person left, the certificate lives on.
- Access straight into the whole network, although the employee needs one server or one folder.
A normal plane is dull. From the outside only the VPN is visible. It has a second factor. Accounts are named. A person who left loses access the same day. Inside, a person reaches their own systems, not the whole office. That is an infrastructure audit, not "an hour of router setup".
Lexora looks at this plane separately from the site. If the storefront pentest is already done and nobody has touched remote access, the second check is more useful than another report on the homepage.
Related Lexora services
Is more than the site facing the internet?
We will check remote access and say what to take off the perimeter.