The short answer
Jump Hosts
A jump host is a hardened server in the industrial DMZ that every remote session terminates on before a second, separately authenticated connection is opened to a control-zone system. It carries the engineering and remote desktop tools needed for the work, records sessions, requires multi-factor authentication, has no path to the internet, and is permitted by the firewall to reach only the specific control hosts named in the access procedure. The remote user works on the jump host; their own machine never touches the control network.
Key points
- Two hops, two authentications: outside to the jump host, jump host to the target.
- The remote machine never connects to the control zone. Only the jump host does.
- Firewall rules from the jump host into control name specific hosts and ports, per session where possible.
- Record every session. The recording is the change record and the evidence.
- A jump host with a browser and internet access is a workstation, not a jump host.
What it does
Remote access to a control system has two problems. The first is that the machine connecting from outside is unknown: a vendor laptop that has been on other networks, a home computer, a phone. The second is that whatever it connects to becomes reachable by whatever is on that machine. The jump host solves both by being the only thing outside connections can reach, and by being a machine the utility owns, hardens, and watches.
The remote user authenticates to the jump host, with multi-factor authentication, and gets a desktop or a shell on it. From there they open a second connection to the target system, authenticating again with an account on that system. Everything they do happens on the jump host with the tools installed there. Their own machine sends keystrokes and receives screen images and nothing else. Files move only through a controlled transfer path with scanning, never by drag and drop into the session.
Hardening
| Control | What it means on the jump host |
|---|---|
| Minimal build | The operating system with only the roles the jump host needs: remote desktop services or a shell, the engineering tools, the session recorder. No browser, no email client, no office suite. |
| No internet | Firewall rules deny the jump host any path to the internet. Updates arrive through the patch staging server. |
| Multi-factor authentication | Every login to the jump host, without exception, including administrators. |
| Named accounts | One account per person, with the vendor company and the individual identifiable. No shared accounts. Disabled between sessions where the access model calls for it. |
| Least reach | Firewall rules from the jump host into the control zone permit only the hosts and ports required. Where possible, rules are enabled per session and disabled after. |
| Session recording | Video or keystroke recording of every session, stored outside the jump host, retained on a schedule. |
| Logging | Logins, failures, connections opened inward, and file transfers, sent to a log server the jump host cannot alter. |
| Patched first | The jump host is the most exposed control-related system and is patched on the enterprise schedule, not the control schedule. |
| Clipboard and drive redirection off | The remote desktop session does not map the remote drives, clipboard, or printers into the jump host. |
| Idle timeout and session limits | Sessions end after inactivity and after a maximum duration; a forgotten session is a door left open. |
The tools on it
A jump host carries what remote work needs: the PLC programming software for the controller families on site, the SCADA configuration client, a remote desktop client, a terminal emulator, and the vendor tools for drives and analyzers. Each is installed and licensed by the utility, kept current, and configured with the project files fetched from the engineering backup store rather than stored on the jump host permanently. A jump host that accumulates project files becomes the place an attacker would look for them.
Reaching the target
From the jump host, the second connection uses the protocol the target expects: remote desktop to a SCADA server, the programming protocol to a controller, HTTPS to a device web page. The firewall between the DMZ and the control zone allows the jump host, and only the jump host, to open those connections, and only to the targets listed. A vendor supporting the membrane skid gets a rule to the skid controller; they do not get a rule to the plant PLCs. When the access procedure enables rules per session, the rule for that target is turned on by the utility for the session and turned off after.
Alternatives and adjuncts
- Privileged access management platforms
- Commercial products that combine the jump host, credential vaulting, session recording, and approval workflow into one system. The jump host concept is inside them; they add credential injection so the remote user never learns the target password.
- Browser-based remote access gateways
- Present the target desktop in a browser through a gateway in the DMZ. The gateway is the jump host; the same hardening applies.
- VPN directly into the control zone
- What the jump host replaces. A VPN that lands a remote laptop on the control network makes that laptop a control-zone device. A VPN that lands on the DMZ and then requires the jump host is the intended design.
- Vendor cloud remote access tools
- A cloud relay that both the site and the vendor connect to outbound. Acceptable only if the site side terminates on a jump host with the same controls; unacceptable if the relay agent runs on a SCADA server or a PLC gateway with direct control-zone reach.
Operating it
- Review the session log weekly and after every vendor visit. Who connected, when, to what, for how long.
- Review the firewall rules from the jump host quarterly. Remove any rule whose conduit no longer exists.
- Test the recording. A recorder that has silently stopped is discovered when the recording is needed.
- Rebuild the jump host from a known image on a schedule or after any suspected compromise. It holds no data worth keeping.
- Alarm on failed logins above a threshold and on any login outside an approved session window.
Frequently asked questions
- Is a jump host necessary if we have a VPN?
- A VPN authenticates the connection and encrypts it; it does not stop the remote machine from being what it is. The jump host is what keeps that machine off the control network. Use the VPN to reach the DMZ and the jump host to go further.
- Can the jump host be a virtual machine?
- Yes, and it usually is. A virtual machine on a DMZ host is easy to snapshot, rebuild, and isolate. It must not be on the same hypervisor as control-zone servers unless the hypervisor and its management network are themselves treated as control-zone assets.
- How do vendors move files in?
- Through a transfer server in the DMZ with malware scanning, or through a utility-controlled file share the jump host can read. Not by remote desktop drive mapping, and not by email to an operator who copies it onto a SCADA server on a USB stick.
- What about emergency access when the jump host is down?
- A second jump host, or a documented break-glass procedure with physical presence at the site. The wrong answer is a standing bypass rule for emergencies, which is a standing bypass rule.
Related topics
- Vendor Remote AccessIntegrators and equipment vendors need to get in. How to let them without leaving a permanent door open: utility-controlled sessions, named accounts, MFA, a jump host, session recording, and what to do about the modem you did not know was there.
- Industrial DMZ DesignThe buffer zone between the business network and the control system: what goes in it, the no-direct-path rule, push-not-pull data flows, the firewall pair, and the services a utility actually needs to place there.
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- Controller HardeningWhat can be locked down on a PLC or RTU: keyswitch and mode, credentials, unused services, access lists, firmware, and the engineering workstation that is the real target.
- The Purdue ModelThe reference architecture most segmentation designs still start from: what each level contains, where the DMZ goes, and how it maps to a water utility.
- VPN DesignHow a VPN fits remote access for a control system: it terminates in the DMZ and lands on a jump host, never the control network; site-to-site tunnels carry telemetry; user tunnels require multi-factor and individual accounts; the concentrator is patched fast.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.