--- title: The Bastion Host Was a Good Idea in 2010 | daily.dev description: Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern... canonical: https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Bastion Host Was a Good Idea in 2010 | daily.dev og:description: Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern... og:url: https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz og:image: https://api.daily.dev/og/posts/wMWkXfOGZ.png og:image:alt: The Bastion Host Was a Good Idea in 2010 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Bastion Host Was a Good Idea in 2010 **[strongdm](https://daily.dev/sources/strongdm)** · 9 min read · 47 upvotes · 0 comments ## Summary Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern hybrid cloud environments with ephemeral resources, multiple accounts, and Kubernetes clusters have broken the core assumptions behind the bastion model. Three key problems emerge: single point of failure, lack of identity-aware auditing (only a shared hop, not per-user attribution), and ongoing maintenance burden. Adding a secrets vault like AWS Secrets Manager helps with credential hygiene but leaves a 'last mile' integration gap requiring custom glue code. StrongDM is presented as a solution that integrates directly with existing vaults, pulling credentials just-in-time into sessions without exposing them, while providing full identity-aware session recording — eliminating both the bastion and the homegrown integration layer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of breaches involve stolen credentials according to the 2025 Verizon DBIR? Stolen credentials were the top initial access vector in 22% of breaches, and 88% of basic web application attacks involved stolen credentials, according to the 2025 Verizon Data Breach Investigations Report. This underscores why credentials sitting unprotected on a jump host or bastion server pose an ongoing security risk. _Teams weighing credential security tradeoffs compare access approaches like this on daily.dev._ ### How much did exploitation of edge and VPN devices increase according to the 2025 Verizon DBIR? Exploitation of edge and VPN-style devices rose roughly eightfold year over year in the 2025 Verizon Data Breach Investigations Report. Only about 54% of those vulnerabilities were patched, with a median remediation time of 32 days, making internet-facing chokepoints like bastion hosts an increasingly attractive attack target. _Engineers hardening internet-facing infrastructure track findings like these on daily.dev._ ### What are the main drawbacks of using a bastion host for cloud infrastructure access today? Bastion hosts create a single point of failure since one box, one config, and often one person understand the failover setup. They also provide a shared hop rather than per-user identity, weakening audit trails to show only that traffic passed through rather than who did what. Additionally, they carry ongoing maintenance costs for patching, key rotation, and manually bolted-on session logging. _Teams debating bastion versus identity-aware access models weigh options like this on daily.dev._ ## Similar posts on daily.dev - [The Bastion Host Bill Nobody Sends to Finance](https://daily.dev/posts/the-bastion-host-bill-nobody-sends-to-finance-xkjohqq3n) · strongdm · 0 upvotes · 0 comments - [You Can't Leak a Key You Never Held](https://daily.dev/posts/you-can-t-leak-a-key-you-never-held-v4tv2u8ax) · strongdm · 0 upvotes · 0 comments - [After Mythos: Identity Has to Anchor in Hardware](https://daily.dev/posts/after-mythos-identity-has-to-anchor-in-hardware-cc1hwkqsf) · Smallstep · 0 upvotes · 0 comments - [Kubernetes Secrets and ConfigMaps in 2026: the Secret is the last mile](https://daily.dev/posts/kubernetes-secrets-and-configmaps-in-2026-the-secret-is-the-last-mile-cq5l9gosq) · Giant Swarm · 11 upvotes · 0 comments - [Building Secure User Portals for Content-Heavy SaaS Applications](https://daily.dev/posts/building-secure-user-portals-for-content-heavy-saas-applications-yxrdpjepe) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#strongdm](https://daily.dev/tags/strongdm) [View this post on daily.dev](https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Bastion Host Was a Good Idea in 2010","url":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz"},"datePublished":"2026-07-24T00:30:41.193Z","dateModified":"2026-09-14T06:38:34.976Z","description":"Bastion hosts were a sensible security solution in the early cloud era, providing a single hardened entry point to reduce attack surface. However, modern...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94e847707bd4dfad18121bf8f52a2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94e847707bd4dfad18121bf8f52a2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"strongdm","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"strongdm","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e72a1ea8a0264b83be7c0e7fce380f12","url":"https://daily.dev/sources/strongdm"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":47},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,strongdm","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"strongdm","item":"https://daily.dev/sources/strongdm"},{"@type":"ListItem","position":3,"name":"The Bastion Host Was a Good Idea in 2010"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz#faq","mainEntity":[{"@type":"Question","name":"What percentage of breaches involve stolen credentials according to the 2025 Verizon DBIR?","acceptedAnswer":{"@type":"Answer","text":"Stolen credentials were the top initial access vector in 22% of breaches, and 88% of basic web application attacks involved stolen credentials, according to the 2025 Verizon Data Breach Investigations Report. This underscores why credentials sitting unprotected on a jump host or bastion server pose an ongoing security risk. Teams weighing credential security tradeoffs compare access approaches like this on daily.dev."}},{"@type":"Question","name":"How much did exploitation of edge and VPN devices increase according to the 2025 Verizon DBIR?","acceptedAnswer":{"@type":"Answer","text":"Exploitation of edge and VPN-style devices rose roughly eightfold year over year in the 2025 Verizon Data Breach Investigations Report. Only about 54% of those vulnerabilities were patched, with a median remediation time of 32 days, making internet-facing chokepoints like bastion hosts an increasingly attractive attack target. Engineers hardening internet-facing infrastructure track findings like these on daily.dev."}},{"@type":"Question","name":"What are the main drawbacks of using a bastion host for cloud infrastructure access today?","acceptedAnswer":{"@type":"Answer","text":"Bastion hosts create a single point of failure since one box, one config, and often one person understand the failover setup. They also provide a shared hop rather than per-user identity, weakening audit trails to show only that traffic passed through rather than who did what. Additionally, they carry ongoing maintenance costs for patching, key rotation, and manually bolted-on session logging. Teams debating bastion versus identity-aware access models weigh options like this on daily.dev."}}]} ```