← All Posts
Infrastructure 6 min read

Privileged Access Control: Lessons from a Bastion Host Deployment

Third-party vendor access is one of the most consistently under-monitored risks in enterprise environments. Here's how to design and implement a Bastion Host architecture that gives you real visibility and control — and what we learned doing it.

In any complex enterprise environment, dozens of third-party vendors have access to your systems on a regular basis — hardware maintenance engineers, software support teams, managed service providers, system integrators. Most organizations have policies governing this access. Far fewer have technical controls that actually enforce those policies and produce an audit trail that would hold up to scrutiny.

The gap between the policy ("vendors may only access designated systems during authorized maintenance windows with a company escort") and the technical reality (vendor VPN credentials that work 24/7 and have never been revoked from engineers who left the vendor two years ago) is where risk lives.

The Problem with VPN-Based Vendor Access

Traditional vendor access via VPN has several fundamental weaknesses:

The Bastion Host Architecture

A Bastion Host (also called a jump server or privileged access workstation) sits between external users and internal systems. All third-party access flows through it. The architecture creates a single, monitored, controlled access path.

The core components we implemented:

Session recording

Every session — RDP and SSH — is recorded in full. Screen capture for RDP, keystroke logging for SSH. Sessions are stored with a retention period aligned to our audit requirements. When an auditor asks "what did this vendor do on this system on this date," the answer is a recording, not a recollection.

Just-in-time access provisioning

Vendors don't have persistent access credentials. When a maintenance window is scheduled, a request is raised in the access management system. After approval, time-limited credentials are provisioned — valid for the duration of the maintenance window only. When the window expires, the credentials are automatically revoked. No manual cleanup required.

System-specific access control

Access through the Bastion is scoped to specific target systems. The network virtualization vendor can reach the vSphere management interface. They cannot reach the backup systems, the SIEM, or anything else. Network segmentation enforces this at the infrastructure level — not just in the Bastion's access policy.

MFA for all external access

Every vendor session requires MFA. The MFA token is delivered to the vendor's registered device. This prevents credential sharing and ensures that only the authorized individual is connecting — not a colleague using the approved engineer's credentials.

"You cannot manage what you cannot see. Before the Bastion deployment, we had policies about vendor access. After it, we had visibility into vendor access."

What We Caught in the First Month

The first thirty days of operation were instructive. Session recordings and real-time monitoring revealed:

None of these would have been visible under the previous VPN-based model.

Operational Considerations

Availability requirements

The Bastion becomes a critical component in your infrastructure: if it's unavailable, vendors can't perform maintenance. High availability deployment — at minimum active/passive — is non-negotiable. We deployed dual Bastion hosts across separate availability zones with automatic failover.

Internal privileged access

The same architecture that governs vendor access can govern internal privileged access. Domain admins, database administrators, and infrastructure engineers accessing production systems through the Bastion provides the same session recording and access control for internal privileged accounts. This is a natural extension that most organizations implement in a second phase.

Integration with SIEM

Bastion session logs should feed into the SIEM. Access outside approved windows, access to unauthorized systems, sessions running longer than typical for the vendor role — these are correlations that the SIEM can alert on automatically.

Key Takeaways

Related →
SIEM Implementation: Key Lessons from the Field
Related →
Zero Trust Architecture: Where to Actually Start