Microsoft’s recent Project Honolulu announcement introduces a new method of managing Windows Server systems from a centralized HTML5 web application, moving away from the legacy MMC snap-ins. This now makes it much easier than using a command line tool for ad-hoc configuration and troubleshooting tasks that depend more on exploration and investigation rather than scripting and automation.

Giving access to web-based administration is a great way of supporting the need for mobility in the workforce, however each one of these systems can increase an organisation’s attack surface. Data breaches frequently result from poor authentication practices, weak passwords, and even unsecure remote access, which remains as the #1 method of compromise according to Trustwave’s 2017 Global Security Report. By implementing this new web-based management method, organisations could inadvertently create a significant security risk. In a worst-case scenario, a threat actor could destroy or reconfigure the whole infrastructure with a few simple clicks if this system was compromised.

But there is good news. Implementing the following simple controls allows organisations to provide remote access to these new Windows sever management tools and remain secure.

With the drive by Microsoft and other vendors launching new tools to enable IT teams to do their jobs with more efficiency and speed, comes additional risks. By ensuring the right controls and security are implemented around all remote access pathways into your infrastructure, organisations can take full advantage of the benefits that these new tools can provide.