Harden your Bastion or Move away !!

         The bastion host toplogy is well suited for relatively simple networks (e.g. those that don't offer any public Internet services.) The key factor to keep in mind is that it offers only a single boundary. Once someone manages to penetrate that boundary, they've gained unrestricted (at least from a perimeter protection perspective) access to the protected network. 

Two questions to those who are using bastion in their environment:

• Is it protected from attackers?
• When it is compromised, will the integrity of the internal network still be protected?

"Anyone with a Screwdriver Can Break In"

The bastion model does have following downsides:

1. Bastion must be managed and patched.
2. It accrues cost while it is running.
3. Each of your security groups that allow bastion access require a security group ingress rule, normally port 22 for SSH or port 3389 for RDP.
4. Private RSA keys for the bastion host and application hosts need to be managed, protected, and rotated.
5. SSH activity isn’t natively logged.

"System logs are invaluable tools for detecting and terminating attacks"

Harden your Bastion - Ensure you haven't left a hole:

1. Enforce - Two factor Authentication
2. Implement Fail2ban - Restrict against automated SSH attempts if your Bastion IP's are red-handed
3. Disable all non-required services 

Establish a Bastion Baseline:

1. Monitoring processor utilization to see the current system loads
2. Analysing system logs to understand how the system runs normally - Enable in-depth logging 
3. Run network weakness scanners such as NESSUS,NAMAP,SATAN
4. Ensure your Operating system is frequently updated with latest Patches,Service packs and Software upgrades. 

The Solution:

Move away from Bastion!!

If your Bastion is not hardened or failed to establish a recommened baselines yet - Jump out of Jump Host and prefer any of following natively secured topologies. 

1. Replace a Bastion Host with Amazon EC2 Systems Manager
2. Using OpenVPN Server