Category: Network Security

Bastion Host

Also known as: Jump Host, Jump Server, Jump Box

Simply put

A bastion host is a specially hardened computer positioned to be the single, controlled entry point into a private network from a less trusted network such as the internet. It is designed and configured to withstand attacks, so that administrators can reach internal systems without exposing those systems directly to untrusted networks. Because it sits at the boundary, it concentrates and limits access rather than allowing many direct connections.

Formal definition

A bastion host is a special-purpose, hardened system deliberately exposed to an untrusted network and configured to resist attack, typically serving as a controlled intermediary (for example, a second SSH layer or an RDP/SSH gateway) in front of one or more private instances that are not directly reachable from the outside. Its role is to mediate and audit administrative access to a private network segment, minimizing the attack surface of internal hosts by requiring connections to transit a single, monitored, and locked-down point. Managed implementations exist, such as Azure Bastion, which provides RDP/SSH connectivity to virtual machines without exposing those services publicly. In a PCI DSS context, use of a bastion host may support access control and network segmentation objectives, but its contribution to scope and control effectiveness depends on its specific configuration, hardening, logging, and validation rather than on the label alone; confirm applicable requirements against the current published standard.

Why it matters

A bastion host addresses a fundamental exposure problem: internal systems that hold or process sensitive data should not be directly reachable from untrusted networks such as the internet. By concentrating administrative access into a single hardened, monitored entry point, a bastion host reduces the attack surface of internal hosts and makes remote administration something that can be controlled, logged, and audited rather than scattered across many direct connections. This design supports the broader principle of limiting and monitoring pathways into a private network.

In a PCI DSS context, a bastion host may support access control and network segmentation objectives, but its value depends entirely on how it is configured, hardened, logged, and validated — not on the label. A poorly hardened or inadequately monitored jump host can itself become a high-value target, since it sits at the boundary and mediates access to protected systems. Because it is deliberately exposed to an untrusted network, the bastion host must be treated as a critical control that is maintained, patched, and reviewed with corresponding rigor.

A bastion host is one layer among several and does not by itself guarantee secure access or eliminate the risk of compromise. It helps enforce a controlled, single point of entry, but it must be combined with strong authentication, least-privilege access, comprehensive logging, and appropriate segmentation. Organizations should confirm which specific requirements apply, and how a bastion host contributes to scope and control effectiveness, against the current published PCI DSS standard rather than assuming its presence satisfies any given requirement.

Who it's relevant to

Security Engineers and Network Architects

Those designing network segmentation and remote administration paths use bastion hosts to establish a single, hardened, monitored entry point into private segments, reducing the attack surface of internal systems that should never be directly reachable from untrusted networks.

Cloud and Infrastructure Teams

Teams operating cloud environments may deploy self-managed jump hosts or managed services such as Azure Bastion to provide RDP/SSH connectivity to virtual machines without exposing those services publicly, and are responsible for the hardening, patching, and logging that determine whether the control is effective.

Compliance Officers and QSAs

Those assessing PCI DSS controls need to evaluate whether a bastion host actually supports access control and segmentation objectives based on its specific configuration, hardening, logging, and validation — not its label — and should confirm applicable requirements against the current published standard.

System Administrators

Administrators who rely on the bastion host as their route to internal systems must understand that it concentrates access into a monitored, locked-down point, and that its compromise could expose the systems behind it, making disciplined use, authentication, and least-privilege access essential.

Inside Bastion Host

Hardened Operating System

A bastion host runs a minimized, security-hardened OS with unnecessary services, ports, and software removed to reduce the attack surface exposed to untrusted networks.

Single-Purpose Access Point

The host is dedicated to a narrow function, typically brokering administrative or user access from a less-trusted network into a more-trusted network segment, rather than running general workloads.

Network Positioning

It is typically placed at a boundary between networks, such as a screened subnet or between the internet and internal segments, so it mediates traffic crossing trust zones.

Strong Authentication and Access Controls

Access to and through the bastion host is gated by strong authentication mechanisms and least-privilege authorization, since it is an exposed entry point.

Logging and Monitoring

Because it sits at a trust boundary and handles administrative sessions, a bastion host is a focal point for detailed session logging, audit trails, and monitoring.

Relationship to Segmentation

In segmented environments, a bastion host can serve as a controlled gateway into a sensitive segment; whether it falls in or out of a given compliance scope depends on how the segment and its connections are defined and validated, not on the label alone.

Common questions

Answers to the questions practitioners most commonly ask about Bastion Host.

Does deploying a bastion host on its own bring in-scope systems into PCI DSS compliance?

No. A bastion host is an architectural control that helps reduce exposure by providing a single, hardened point of administrative access into a sensitive network segment; it does not by itself make an environment compliant. PCI DSS compliance depends on how the host and the systems it fronts are configured, monitored, and validated against the applicable requirements in the current published standard, not on the mere presence of a bastion host. Confirm requirement numbering and wording against the version you are assessing rather than assuming the control satisfies a specific requirement.

Is a bastion host the same thing as a firewall or a VPN concentrator?

No. These serve different functions and are often used together. A firewall enforces network traffic rules between segments, and a VPN concentrator terminates encrypted remote-access tunnels. A bastion host is a hardened intermediary system through which administrators pass to reach systems in a protected segment, typically for interactive or administrative sessions. A bastion host may sit behind a firewall and be reached over a VPN, but it is a distinct control with its own hardening, logging, and access-control considerations.

Where should a bastion host be placed relative to a cardholder data environment?

A bastion host is commonly positioned so that administrative access to the cardholder data environment must traverse it, rather than allowing direct connections from general networks. Placement should reflect your segmentation design, so that the host is the controlled chokepoint into the sensitive segment. Because it can provide access into or adjacent to in-scope systems, treat the bastion host as in scope and apply the relevant configuration, access, logging, and monitoring controls. Validate the segmentation and access paths against the current standard.

What hardening measures are typically applied to a bastion host?

Common measures include removing or disabling unnecessary services, accounts, and software; restricting inbound access to defined source addresses and required ports only; enforcing strong, individual authentication; and applying multi-factor authentication for administrative access. Additional practices include keeping the system patched, enabling detailed logging of sessions and commands, and forwarding those logs to a protected, centralized location. Confirm the specific control expectations and their wording against the version of PCI DSS you are following.

How should access to a bastion host be authenticated and monitored?

Access should use unique, individually attributable credentials rather than shared accounts, with multi-factor authentication applied to administrative access consistent with the applicable requirements. Sessions should be logged with sufficient detail to support attribution and review, and those logs should be protected against tampering and monitored for anomalies. Keep in mind that multi-factor authentication addresses credential-based access risk and does not by itself address other risks such as compromised endpoints or session hijacking, so it should be combined with other controls.

What are the limitations of relying on a bastion host as an access control?

A bastion host reduces the number of exposed entry points and centralizes administrative access, which can make monitoring and enforcement easier, but it is a single control with limits. It does not protect against compromised administrator credentials or endpoints on its own, and if the host itself is misconfigured or unpatched it can become a high-value target. It also does not remove the need for segmentation, logging, patching, and other controls on the systems behind it. Treat it as one layer within a defense-in-depth approach rather than a control that eliminates access risk.

Common misconceptions

A bastion host is a firewall.

A bastion host is a hardened, single-purpose access point that mediates connections into a network, whereas a firewall enforces traffic-filtering rules. They serve different functions and are often deployed together rather than being interchangeable.

Deploying a bastion host removes systems it fronts from a cardholder data environment or compliance scope.

Whether a bastion host reduces or affects scope depends on how connectivity and segmentation are implemented and validated. A bastion host that can access a sensitive segment may itself be in scope, and scope determinations should be confirmed against the current published standard rather than assumed from the architecture label.

A bastion host prevents intrusion because it is hardened.

Hardening is intended to reduce the attack surface and help mitigate risk, but it does not guarantee prevention of compromise. Because a bastion host is intentionally exposed to untrusted networks, it requires ongoing monitoring, patching, and access controls to manage residual risk.

Best practices

Minimize the host by removing unnecessary services, software, ports, and accounts so only the functions required for its single purpose remain.

Enforce strong authentication and least-privilege authorization for all access to and through the host, limiting who can use it and what they can reach.

Enable detailed session logging, audit trails, and active monitoring, and review them regularly since the host is an exposed boundary access point.

Position the host deliberately at the trust boundary and restrict inbound and outbound connectivity to only the networks and destinations it must broker.

Keep the operating system and software promptly patched and apply hardening baselines consistently, treating the host as a high-value, internet-adjacent target.

Document and validate how the bastion host interacts with segmented environments, and confirm its scope treatment against the current published standard rather than assuming based on architecture.