Hey! Glad to hear you recorded your assessment of this incident. Firstly, great work on detailing your troubleshooting steps! It's good to see someone's thought process in action! Also, I'm not a Windows sysadmin, so some of the suggestions were really interesting.

You said about talking about our worst breaches, it wasn't horrific, but I left VNC open on the machine I used to play media at home in ~2010. My first sign was that someone had opened a web browser on the desktop (which I never did) so I could see they were just using it to browse for content they were blocked from accessing. It wasn't even dodgy stuff, just personal sites.

I rebuilt the machine and turned off RDP, but that gave me a real scare.

You said about using a VPN but needing to make sure it's up to date, can I suggest looking at one of the mesh VPN products, like Tailscale, Nebula or Netbird? I used Tailscale to provide remote support to my aunt and to share content on my home network via a proxy on my VPS.

At work, I'm investigating Netbird, which is similar to Tailscale, but has the control plane hosted on a web server you control. I've previously used Nebula, but after one mishap with the PKI, I realised I couldn't trust myself to run that in the way I needed to to be managed.

All the very best, and thanks again for the content!
