What it means
Bastion-host architecture creates a controlled administrative entry point with hardened access, strong identity, session oversight, and limited paths to protected systems.
Why it matters
A jump host can reduce exposure, but it can also become a concentrated credential and lateral-movement target if treated as an ordinary server.
Practical focus
- Define the scope, owners, acceptable risk, and required outcome for bastion host architecture before choosing a tool or platform feature
- Implement dedicated administration paths, MFA, short-lived privileges, hardened clients, session logging, isolation, and rapid rebuild through documented, reviewable configuration and change control
- Collect administrator identity, session start and end, targets, commands where permitted, file transfer, privilege use, and configuration drift and compare the results with approved baselines, service objectives, and policy requirements
- Exercise a compromised bastion providing broad persistent access or administrators bypassing it through unmanaged direct connections as a planned test case, including detection, containment, rollback, escalation, and evidence retention
Common mistakes
- Treating bastion host architecture as a one-time technical setting instead of an operating control with owners and review cycles
- Using default thresholds or broad exceptions without connecting them to business, privacy, security, and availability requirements
- Keeping evidence in disconnected tools so reviewers cannot reconstruct who changed what, why it changed, or whether it worked
- Testing only the normal path and discovering during an incident that a compromised bastion providing broad persistent access or administrators bypassing it through unmanaged direct connections was never rehearsed
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: