Bastion Host
What is Bastion Host?
A specially hardened computer on a network designed to withstand attacks and serve as a single point of entry to internal resources. Bastion hosts are typically placed in a DMZ and run minimal services.
Terms that appear alongside bastion host
Each of these is named in at least one of the same controls as bastion host. The number is how many controls name both.
- remote access 2 shared controls
- nist 2 shared controls
- jump server 2 shared controls
- access control 2 shared controls
Frameworks that govern bastion host
What the standards actually require on bastion host
Requirements naming bastion host across 5 standards, quoted from the control text.
ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...
ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →Implement NIST 800-53 AC Access Control family + IA Identification and Authentication family per MARS-E v2.0 catalog. NIST 800-63-3 Identity Assurance Level 2 (IAL2) + Authenticator Assurance Level 2 (AAL2) + Federation Assurance Level 2 (FAL2) for Exchange co...
MARS-E-Access-Control-Identity-Authentication-NIST-800-63-Identity-Assurance-Levels-MFA-AC-IA-Families · MARS-E Access Control + Identity + Authentication + NIST 800-63 + MFA + AC + IA Families →Administrator access security, protecting cloud administration from unauthorised change. Level 1 (a to e): admin access into the network used to manage the cloud service permitted only from named IP addresses;
mtcs-singapore::22.8 · Administrator access security →Apply Section 6.3 network security including: network segmentation per NIST SP 800-207 Zero Trust + microsegmentation + DMZ + jump servers + bastion hosts + perimeter firewalls + host-based firewalls + IDS/IPS + DDoS protection + DNS security (DNSSEC + DoH) +...
NISTSP123-6 · Network Security and Server Communications →Apply Section 7.3 identity and access in cloud including: federated identity (SAML 2.0 + OAuth 2.0 + OIDC + WS-Federation) with an identity provider (IdP) + MFA (FIDO2 + WebAuthn + TOTP + biometric) + Single Sign-On (SSO) + risk-based authentication.
NISTSP144-5 · Identity and Access in Cloud, Federation, and Privileged Access →Questions people ask about bastion host
What is Bastion Host?
Why is Bastion Host important for compliance?
Which compliance frameworks address Bastion Host?
Where can I learn more about Bastion Host?
See how Bastion Host applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.