NAVIGATING THE RDP SECURITY CONSEQUENCES OF TLS VS. NLA FROM A THREAT EXPOSURE PERSPECTIVE

Summary from the TLDR InfoSec newsletter

This article compares RDP security using TLS-only versus NLA. NLA-secured servers faced significantly more login attempts but also provided more insights into attacker tactics. Geographical origins of attacks differed between NLA and TLS, with certain countries showing preferences for one protocol over the other. While NLA is considered more secure, it may attract more sophisticated attacks. Researchers found NLA honeypots to be more valuable for understanding cybersecurity threats and the human element behind them.