The honest answer first: the jump server was good engineering for its time — one hardened choke point, one audit trail, one firewall rule. It fails modern scrutiny for one architectural reason: it still ends in a direct network path, with high-privilege credentials cached in its memory. Microsoft retired its own Red Forest admin model, ransomware crews live off the RMM tools that bypass your bastion, and CyFun auditors now ask questions a jump box cannot answer. The replacement is not “no intermediary” — it is an intermediary that breaks the protocol instead of forwarding it.
Key takeaways
- The core weakness is credential caching: RDP logons leave NTLM hashes and Kerberos tickets in the jump host’s LSASS memory, one Mimikatz dump away from pass-the-hash across the domain.
- Microsoft retired its ESAE/Red Forest guidance (December 2020) for the cloud-integrated Enterprise Access Model — the vendor that canonised admin forests moved on.
- The 2024 incident record targets exactly this layer: AnyDesk’s production breach leaked 18,000+ customer credentials, and ScreenConnect CVE-2024-1709 (CVSS 10.0) handed LockBit affiliates admin accounts on remote-management servers.
- IEC 62443, ISO 27001 A.8.2 and the Belgian CyFun framework demand MFA, least privilege, session auditing and zone boundaries that flat jump hosts fail structurally.
- The modern pattern is the protocol break: RDP/SSH terminate at an isolation gateway that streams pixels to a browser — no TCP path from admin laptop to target, no credentials on the endpoint, and each self-managed jump VM you retire saves an estimated €3,500–€6,000 a year.
The case FOR the jump host — taken seriously
Bastions earned their place: a single hardened ingress point for RDP (3389) and SSH (22), centralised session logging, strict firewall scoping, and in OT the formalised Purdue Level 3.5 DMZ that breaks direct routing between enterprise IT and the plant floor — the architecture covered in our Purdue model guide. Cloud providers industrialised the same idea as Azure Bastion and AWS SSM. And practitioners defending jump hosts on r/sysadmin make two fair points: thick engineering clients like Siemens TIA Portal and Rockwell Studio 5000 need a real Windows desktop with native drivers, and an on-prem box keeps working when your cloud IdP or WAN link does not. Any replacement has to answer those points, not wave at them.
Where the pattern breaks
| Weakness | Mechanism | Evidence |
|---|---|---|
| Credential caching | Domain-admin RDP logons leave NTLM hashes and Kerberos TGTs in LSASS; local admin on the box → Mimikatz → pass-the-hash domain-wide | Microsoft’s own tiering guidance; SpecterOps attack-path research |
| Springboard placement | One breached bastion is a privileged foothold inside every segment it reaches | The lateral-movement pattern detailed in how attackers move once inside |
| MFA stops at the door | MFA on the bastion login, then single-factor RDP/SSH hops onward with static keys | Violates continuous-verification principles auditors now test |
| Session sprawl | Disconnected-not-logged-off RDP sessions linger, hijackable | Standard finding in AD security assessments |
| Patching burden | A full Windows/Linux OS on the security boundary itself | €3,500–€6,000 per VM per year in labour and hosting |
| Vendor’s own retreat | Microsoft retired ESAE/Red Forest (Dec 2020) for the Enterprise Access Model: cloud-integrated, identity-centric, tiered planes | Microsoft privileged-access strategy |
The adjacent failure mode is worse: teams bypass the bastion entirely with RMM tools. In January 2024 AnyDesk’s own production systems were breached — source code and signing certificates stolen, 18,000+ customer credentials later listed on dark-web forums. Weeks later, ScreenConnect’s CVE-2024-1709 (CVSS 10.0 authentication bypass, CISA KEV) let LockBit affiliates create admin accounts on remote-management servers at scale. CISA/FBI advisories document BianLian and LockBit installing legitimate AnyDesk, TeamViewer and Atera precisely because signed admin tools blend into baselines and evade EDR. Every unmanaged remote-access path is a bastion without the audit trail.
What the frameworks now require
The compliance bar has been raised to exactly the height a flat jump host cannot clear. IEC 62443-3-3 demands unique human authentication (SR 1.1), MFA for untrusted-network access (SR 1.9), automatic session termination (SR 2.6) and zone-boundary protection (SR 5.1/5.2). ISO 27001:2022 A.8.2 requires managed privileged access rights, A.8.22 network segregation. The Belgian CyFun framework — mandatory verification for essential entities since 18 April 2026 — operationalises NIS2 into privileged-identity governance, MFA, log review and supplier-access controls, with fines to €10 million or 2% of turnover behind it. And CISA/NSA OT guidance is blunt: eliminate always-on, unmonitored vendor access; require on-demand activation, MFA and session recording. A bastion with entry-MFA and event logs meets perhaps half of that list.
The alternatives, compared
| Capability | Legacy jump host | Jump host + PAM | ZTNA per-app tunnel | Browser-rendered isolation |
|---|---|---|---|---|
| Direct TCP path client→target | Yes | Yes (proxied) | Restricted, port-specific | No — terminated at gateway |
| Credential location | LSASS on the box | Central vault | IdP/local | Vault/IdP — never on the endpoint |
| Session recording | OS event logs | Full video + keystrokes | Flow logs | Full video + keystrokes |
| MFA scope | Entry only | Vault entry + elevation | Per application | Continuous, per session |
| Thick-client support | Native desktop | Native desktop | Direct TCP works | Rendered desktop / app streaming |
| Maintenance burden | High (full OS) | Very high (vault + proxy) | Low (connectors) | Low (managed gateway) |
| Indicative cost (as of Aug 2026) | €3,500–€6,000/VM/year ops | PAM: €15–€40/user/month (Wallix range); enterprise setups €50,000–€150,000+ | Platform licence | Consolidated in platform licence |
PAM earns its keep — vaulting, rotation, approval workflows, video audit — but at enterprise implementation cost and with the proxy still forwarding a TCP stream. Cloud bastions solve patching but bind you to one cloud. The column that changes the architecture is the last one.
The protocol break: why pixels beat packets
In every traditional model, a TCP socket ultimately connects the admin’s endpoint to the target — carrying RDP virtual channels, clipboard, drive mapping and whatever malware sits on the laptop. A protocol-break gateway refuses that: the RDP or SSH session terminates at the gateway, which renders the desktop or terminal internally and streams only visual updates over HTTPS to a standard browser. Four attack classes disappear at once: the endpoint never gets an IP or socket on the target network (no reconnaissance), binary exploits cannot cross a pixel stream (client malware is stranded), credentials are injected by the gateway from a vault and never touch the admin’s machine, and file transfer or clipboard become gateway-enforced policy decisions. It is the same isolation principle behind web application isolation, applied to admin protocols — and thick-client needs are met by rendering a full desktop or streamed application instead of forwarding the network.
The OT reality check
Machine builders still arrive with TeamViewer on the HMI, an unregistered 4G router in the cabinet, or a site-to-site VPN spanning the whole plant subnet — the patterns CISA warns about, on equipment where agents void warranties and legacy Windows cannot run them anyway. Compliant OT access per IEC 62443 and NIST SP 800-82r3 means: disabled by default with operator approval to activate, MFA before session start, termination in the Level 3.5 DMZ rather than direct routing to PLCs, and continuous session logging with a local kill switch. Browser-rendered access fits this precisely because the vendor side needs nothing installed — the same agentless logic covered for suppliers in third-party access without VPN accounts, and the architecture connecting IT and factory in IT-OT convergence without production risk.
The four-stage migration (no big bang)
- Contain: inventory every jump host, bastion VM and RMM tool; enforce entry MFA; disable credential caching; strip standing Domain Admin from jump-host groups.
- Segment: move OT bastions into a proper Level 3.5 DMZ; adopt the Enterprise Access Model’s tiering (control/management/workload planes); auto-disconnect idle sessions.
- Make privileges ephemeral: vault credentials with injection (admins never see secrets), JIT approval workflows tied to tickets, session recording into the SIEM.
- Isolate: per-app ZTNA connectors, browser-rendered RDP/SSH with protocol break, vendor maintenance switched to on-demand isolated sessions — then decommission the jump VMs.
Keep the choke point, drop the network path
The jump server’s virtues — one entrance, one audit trail — survive; its liabilities — cached credentials, forwarded TCP, a patchable OS on the boundary — do not have to. For EU mid-market IT and OT teams, Jimber packages the destination state directly: browser-rendered isolated access to RDP, SSH and web consoles with the protocol break built in, agentless vendor sessions for the machines nothing can be installed on, JIT-style scoped access and central session visibility — one EU-sovereign platform instead of a bastion fleet plus a PAM project, at flat cost. Stage 1 of the roadmap starts with an inventory; the demo can start with your ugliest jump box. Book it here.
Frequently asked questions
What is the structural difference between a jump server and ZTNA?
A jump server is a network intermediary: once authenticated, the admin holds network-level presence in the target segment. ZTNA grants identity-verified access to specific applications or protocols without placing the device on the underlying network at all.
Why is credential caching on Windows jump hosts so dangerous?
RDP logons cache NTLM hashes and Kerberos tickets in LSASS memory. An attacker with local admin on the jump host dumps that memory (Mimikatz) and replays the hashes — pass-the-hash — to authenticate across the domain without ever knowing a password.
What replaced Microsoft’s Red Forest / ESAE model?
Microsoft retired ESAE in December 2020 for the Enterprise Access Model: a zero-trust framework of control, management and workload planes that favours cloud-native identity protection and modern privileged-access workstations over isolated on-prem admin forests.
How does a browser-rendered protocol break improve security?
RDP/SSH terminate at an isolation gateway that streams only pixels to the browser. Client-side malware cannot traverse the connection, credentials never reach the endpoint, and file transfer and clipboard become policy decisions enforced at the gateway.
Why do CISA and the NSA warn against RMM tools for vendor access?
Signed, legitimate tools like AnyDesk and TeamViewer blend into network baselines and bypass EDR — which is exactly why ransomware groups such as BianLian and LockBit install them for persistent command-and-control.
What does IEC 62443 require for OT remote access?
Unique human authentication (SR 1.1), MFA for access from untrusted networks (SR 1.9), automatic session termination on inactivity, strict zone-boundary protection (SR 5.1/5.2), and monitored, on-demand vendor sessions terminating in the Level 3.5 DMZ.
How do we run thick engineering clients like TIA Portal without a classic jump host?
Through browser-rendered remote application or full-desktop sessions: the software runs on a controlled host near the equipment, and only the rendered interface streams to the engineer — native drivers intact, no open network path.
What does a self-managed jump server actually cost per year?
Roughly €3,500 to €6,000 per VM annually in patching, certificate management, account hygiene and hosting — before counting the risk it concentrates. Multiply by your bastion count and the consolidation maths writes itself.
