Secure remote access for small business: VPN, ZTNA, or RDP

The secure way for a small business to give staff remote access is to never expose an office computer or server directly to the internet. Put every connection behind a VPN, a zero trust network access (ZTNA) service, or a remote desktop gateway, require multi-factor authentication (MFA) to get in, and limit each person to the systems they need. If all your work already lives in cloud apps such as Microsoft 365, you may not need network remote access at all, only well-protected accounts and devices.

Remote access setup for Orange County businesses

Coastal Growth Co. can help plan and configure access to the files, computers, and applications your staff need away from the office. I am based in Laguna Hills, with remote support and on-site work across Orange County by arrangement. We start with the business task and existing equipment before choosing a VPN, a ZTNA service, or another supported option.

Describe what your staff need to reach, including team size and whether they use company or personal devices. Please leave out passwords and sensitive records. We agree the investigation, setup, software costs, and any ongoing support before paid work begins. This work falls within our network and security services.

VPN, zero trust network access, or a remote desktop gateway?

These are the three standard ways to reach office systems from outside.

VPN (virtual private network). Software on the laptop builds an encrypted tunnel to the office firewall. Once connected, the laptop behaves as if it were plugged in at the office. It is well understood and built into most business firewalls. Its weakness is breadth: unless rules narrow it down, a connected laptop can reach the whole office network, so a stolen password or an infected home PC reaches it too.

ZTNA (zero trust network access). Instead of joining the network, each user is granted access to specific applications or machines, and each connection is checked against who the user is and, in many products, the health of the device. NIST describes zero trust as moving defenses “from static, network-based perimeters to focus on users, assets, and resources”. Most ZTNA services connect outbound from a small connector inside the office, so no inbound port has to be opened on the firewall.

Remote desktop gateway. For staff who need to use a desktop application on an office PC or server. Microsoft’s Remote Desktop Gateway role wraps remote desktop sessions in an encrypted HTTPS connection so that users can reach internal resources “without the need for a VPN”, and the remote desktop service itself is never exposed. It requires Windows Server, a public certificate, and MFA added on top.

	VPN	ZTNA	Remote desktop gateway
What the user gets	The office network	Named apps or machines only	The screen of an office PC or server
Inbound port open on the firewall	Yes (the VPN service)	Usually none	Yes (HTTPS)
Access if a password is stolen	Broad, unless rules restrict it	Narrow	One desktop
MFA	Depends on the firewall. Must be set up	Normally through your Microsoft or Google sign-in	Must be added
Ongoing care	Firewall firmware and VPN client updates	Subscription, connector updates	Windows Server patching, certificate renewal
Good fit	A few trusted staff reaching a file server	Mixed staff and contractors, several apps	Line-of-business desktop software that cannot move to the cloud

Why is exposed RDP so dangerous?

RDP (Remote Desktop Protocol) is the Windows feature that lets you control a PC from elsewhere. The shortcut many offices took was a port forward on the router, sending internet traffic on port 3389 straight to an office PC. That puts a Windows login prompt on the public internet for anyone to find.

The FBI and the Department of Homeland Security warned about this in a joint public service announcement, I-092718-PSA: attackers “have developed methods of identifying and exploiting vulnerable RDP sessions over the Internet to compromise identities, steal login credentials, and ransom other sensitive information”. The methods are password guessing at scale and buying stolen RDP logins, followed by ransomware.

CISA’s #StopRansomware Guide gives the current guidance: “Limit the use of RDP and other remote desktop services. If RDP is necessary, apply best practices”, which it lists as auditing the network for systems using RDP, closing unused RDP ports, enforcing account lockouts, applying MFA, and logging login attempts.

How to check whether your office exposes RDP

1. Log in to the router or firewall and open the port forwarding (or NAT) page.
2. Look for any rule that forwards traffic to a computer or server, especially on port 3389.
3. Remember that moving RDP to a different port number does not hide it. Scanners find it.
4. If a forward exists, plan a replacement (one of the three options above), then delete the rule.

The same logic applies to camera recorders, network storage, and remote support tools opened to the internet “just for now”.

MFA on every way in

CISA defines MFA as requiring “a combination of two or more authenticators to verify your identity”. A stolen password alone then gets an attacker nowhere. The ransomware guide is specific about where it matters: “Implement phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems.”

In order of strength:

1. Security keys and passkeys (FIDO). CISA calls this the only widely available phishing-resistant method.
2. Authenticator app with number matching.
3. Text message codes. Easier to intercept than an app prompt. CISA’s position is that any MFA is better than no MFA.

A VPN with a shared password, or with individual passwords and no second factor, is the most common gap. Our explainer on why multi-factor authentication matters covers rollout, and Conditional Access in Microsoft 365 covers rules such as blocking sign-ins from unmanaged devices.

Which option fits a small office?

Everything is in Microsoft 365, Google Workspace, and web apps. You do not need a VPN for daily work. Put the effort into MFA, sign-in rules, and managed devices. That is the core of zero trust for small business.

Staff need files on an office server or network storage. Either the firewall’s built-in VPN with individual accounts, MFA, and rules limiting VPN users to the file server, or a ZTNA service. As one example of published pricing, Tailscale lists a Standard plan at $8 per user per month, as of September 2026. Microsoft’s equivalent, Entra Private Access, ties private resources to the same Conditional Access rules as Microsoft 365. Check Microsoft’s current licensing before planning around it. It is also worth asking whether the files should move to SharePoint or OneDrive, which removes the need altogether.

Staff need a desktop program that only runs in the office. Remote desktop to that PC through the VPN or ZTNA connection, never through a port forward. For several users, a Remote Desktop Gateway or a hosted desktop such as a Windows 365 Cloud PC is tidier than leaving office PCs switched on for the purpose.

An outside vendor or contractor needs occasional access. Give them their own account, access to the one system they support, MFA, and an end date. Avoid shared logins and always-on remote tools.

The devices on the other end

Remote access connects your office to whatever device is on the far end, so the device matters as much as the tunnel.

• Company-managed laptops are the safer default. You can require disk encryption, screen lock, updates, and endpoint protection, and wipe a lost device.
• If personal devices are allowed, write down what is permitted and prefer browser or app access to cloud services over full network access. Our BYOD policy guide has a template approach. NIST’s Guide to Enterprise Telework, Remote Access, and BYOD Security is the reference document.
• Keep the edge patched. CISA’s guidance is to “update VPNs, network infrastructure devices, and devices being used to remote in to work environments with the latest software patches”. VPN services face the internet, so their security updates are urgent, not routine.
• Home computers still on Windows 10: Windows 10 reached end of support on October 14, 2025. See our Windows 10 end-of-life guide before allowing them to connect.
• Home Wi-Fi basics: change the router’s default admin password, use WPA2 or WPA3 with a strong passphrase, and keep router firmware updated.

One performance note: Microsoft recommends that Teams calls and meetings bypass the VPN using split tunneling, because VPNs add delay to real-time audio and video that is already encrypted.

Write a short remote-access brief before buying software

For each person or role, write down the application or resource they need, where it runs, the device they will connect from, and who approves that access. “Use the accounting program on the office PC” is a more useful requirement than “install a VPN.” If the task is already available through a cloud app, check whether an additional office connection is necessary.

Include any vendor restrictions, the current sign-in method, and how access should end when a person leaves. For an occasional contractor, agree the systems they can reach and the date access should expire. A shared account makes it harder to remove one person’s access cleanly.

Decide how the setup will be checked before it is handed over:

• The staff member can complete the required task from outside the office.
• Access to unrelated systems is restricted as intended.
• The agreed sign-in protection is in place on the actual connection path.
• A test account can have its access revoked, with active sessions handled according to the chosen system’s controls.
• Someone is responsible for updates, access reviews, and support after setup.

These are acceptance checks for the agreed work, not a guarantee that a system is risk-free. If the main requirement is Outlook, Teams, or shared cloud files, our Microsoft 365 support page is another starting point.

A setup checklist

1. List who needs remote access and to what, by name.
2. Remove every port forward to an internal computer, recorder, or storage device.
3. Choose VPN, ZTNA, or a gateway for each need.
4. Create individual accounts. No shared logins.
5. Require MFA on the remote access method and on email.
6. Restrict each user to the systems on their list.
7. Turn on logging of connections and failed attempts, and account lockout.
8. Add remote access to the offboarding checklist so it is removed the day someone leaves. See IT onboarding and offboarding.
9. Put firewall and VPN updates on a schedule.
10. Review the access list twice a year.

Common mistakes

• Port-forwarding RDP, or moving it to an unusual port and considering it hidden.
• One VPN login shared by everyone.
• VPN users able to reach the entire network when they need one file share.
• MFA on email but not on the VPN.
• Former employees and old vendors still on the access list.
• Remote support tools left installed and signed in on servers.
• Sending all traffic, including video calls, through the office VPN and then troubleshooting poor call quality.

Common questions

Is a consumer VPN service the same thing as a business VPN?

No. Consumer VPN services route your web browsing through their servers for privacy. They do not connect you to your office. A business VPN is a tunnel between a staff laptop and your own firewall, giving access to your own internal systems.

Is RDP safe to use inside a VPN?

Used that way, it is a reasonable tool. The danger is RDP reachable from the open internet. Behind a VPN, ZTNA, or gateway, with MFA on the way in, individual accounts, and account lockout enabled, the exposure is limited to people who have already proven who they are.

Do we need a VPN if we use Microsoft 365 for everything?

Generally not. Microsoft 365 is already reachable securely over the internet. The protection comes from MFA, Conditional Access, and managed devices. A VPN is only needed for things that physically live in the office, such as a file server or a desktop application.

Is ZTNA too complicated for a five-person office?

Not necessarily. Several services are designed for small groups. The usual pieces are a connector in the office, an app on each laptop, and sign-in through your existing Microsoft or Google accounts. The planning is the same as for a VPN: decide who needs what.

How should we remove access when someone leaves?

Disable their main account first, which cuts off anything tied to single sign-on. Then remove their VPN or ZTNA user, revoke their devices, and change any shared passwords they knew. Having remote access on a written offboarding checklist is what makes this reliable.

How Coastal Growth Co. can help

We review how people currently get into your office systems, find and close exposed ports, and set up the option that fits: firewall VPN with MFA, a ZTNA service, or a remote desktop gateway, with per-user access and logging. This is part of our network and security services, and it can be looked after over time under managed IT. Scope and price are agreed before work begins. Contact us with a short description of what staff need to reach.