Access
Jump Server / Bastion
A hardened intermediate host that all interactive access into OT must traverse.
Critical criticalityLevel 3.5
What it does
Terminates remote sessions, applies authorisation and creates an auditable choke point.
Typically locatedIndustrial DMZ.
At a glance
PurdueLevel 3.5
CategoryAccess
Protocols
Talks toRemote access gateway, OT destinations, Log collectors
Common vendorsMultiple
Why should I care?
Jump Server / Bastion sits at Level 3.5. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Bypass routes that make it optional
- Internet access from the jump host
- Local accounts outside identity governance
If it is compromised
- Broad, legitimate-looking access into control zones
What to monitor
- Session records
- Process execution
- Files transferred
- Direct-to-destination traffic bypassing it
How to defend it
- Make it the only permitted path in firewall rules
- Allow-listing and no internet access
- Short-lived privileged sessions
Hunting
Hunt ideas for this component
Related