Repeated failed logins on the remote desktop gateway

Summary

The monitoring platform reported a steady stream of failed logins on the remote desktop gateway, hundreds per hour, from a single range of addresses abroad. The attempts used common user names one after another.

Impact

No account was compromised. Every attempt failed, and the gateway required a second factor on top of the password. The gateway did slow down during the busiest hour, and two customers noticed a delay when signing in.

Response

The engineer on call blocked the source range on the firewall and set the gateway to lock an account after five failed attempts. Extra alerting is in place, so a new range or a successful login after many failures reaches the on-call engineer directly. The logs are kept for a review of the gateway's exposure to the internet, which is still pending. The Incident stays open until that review has decided whether the gateway can sit behind a VPN.

Notifications

No customer data was involved, so no notification was needed. The affected customers were told about the slow sign-in and what we changed.