A bastion should not become a general-purpose workstation
The moment people start browsing, reading email and installing tools on the jump host, it stops being a control.
It happens gradually and for sensible reasons: somebody needs a browser to download a patch, somebody installs a utility. Each step is reasonable and the end state is a machine with broad access to everything, exposed to the ordinary ways machines get compromised.
More on Architecture patterns
- A jump host concentrates administrative entryOne plank, every crossing
- Bulkheads contain failureThe water stops at the wall
- Out-of-band management survives primary-path failureWhen the bridge is out
- A choke point makes control observableEverything through one gap
- A broker can separate clients from powerful credentialsChained to the bench
- A one-way gateway changes the threat modelWater does not fall upwards