Jump Server

What is a jump server?

A jump server (also called a jump host or jump box) is a hardened intermediate server that forms the only permitted access point between a less-trusted network, such as IT, and a protected network, such as an OT or SCADA zone. Administrators, engineers and external vendors first log in to the jump server and only from there open a session to the target system. As a result, there is never a direct connection between their own workstation and the PLC, the HMI or the engineering station. In OT architectures the jump server usually sits in the IDMZ, the industrial DMZ, at level 3.5 of the Purdue Model. The term is often used interchangeably with bastion host.

🎯 Why do you need a jump server?

A jump server solves a practical dilemma: OT systems must be manageable remotely, yet must not be directly reachable from IT or the internet.

• No direct routes — the firewall only allows traffic from the jump server into OT, not from individual IT workstations
• A single control point — all remote access passes through one place, where you enforce authentication, authorisation and recording centrally
• Limited exposure — protocols such as RDP, SSH, VNC or engineering software only need to be open between the jump server and the target system
• Auditability — sessions can be logged, monitored and recorded for audits and incident investigation
• Remote maintenance — vendors can resolve faults without being on site, under conditions that you define

🔧 How does a jump server work?

A typical access chain into OT looks like this:

1. Establish a connection — the user connects to the IDMZ through a VPN or ZTNA gateway; the jump server itself is never directly reachable from the internet
2. Log in with MFA — the user logs in to the jump server with a personal account and MFA, preferably phishing-resistant (a FIDO2 key or smartcard)
3. Approval — for sensitive access, an operator or PAM system approves the session in advance, often linked to a work permit
4. The jump — from the jump server, the user opens a session to the permitted target system, using credentials injected by the PAM vault so that the user never sees them
5. Recording and termination — the session is logged and, where required, captured with session recording, and it ends automatically after inactivity or when the time window expires

Larger plants often use two hops: a jump server in the IDMZ for access from IT, and a second jump host or engineering station inside the OT zone (level 3) running the heavyweight engineering software.

🧱 What are the characteristics of a good OT jump server?

🔐 How do you harden a jump server?

A jump server is an attractive target: whoever takes it over is one step away from OT. Hardening is therefore a precondition, not an option.

• No internet, no e-mail — the jump server must not browse or send mail; it is an exclusive management gateway, not a general-purpose workstation
• Application allowlisting — only explicitly approved programs may run, so malware and attacker tools cannot start
• MFA — mandatory for every login; MFA on the jump server compensates for the fact that many legacy OT systems cannot support MFA themselves
• PAM integration — passwords for target systems are held in a vault, rotated automatically and replaced after use
• Session recording — video or command recording of every session, especially those of external parties
• Least privilege — each user only sees the target systems that belong to their task
• Controlled file transfer — disable clipboard, drive mapping and drag-and-drop in RDP; files go through a separate transfer facility with malware scanning
• Keep it current — patch management and antivirus or EDR are easier here than on the OT systems themselves, so apply them consistently
• Session limits — automatic logout after, for example, 15 minutes of inactivity, and access only within an agreed time window

🔄 What is the difference between a jump server, a VPN and ZTNA?

In practice they complement each other. A VPN or ZTNA solution brings the user safely as far as the IDMZ, and the jump server determines what they may then do in OT. ZTNA fits the Zero Trust principle; many OT-specific remote access platforms combine ZTNA, PAM and session recording in a single product.

⚠️ What common mistakes should you avoid?

• Jump server in the IT domain — if the jump server is a member of the IT Active Directory, an attacker who gains IT admin rights can move straight on into OT
• Dual use — the jump server is also used for e-mail, browsing or as a general workstation
• Shared accounts — a single vendor account for every technician makes logging worthless
• Always-on access — external access that is active day and night instead of only during an approved intervention
• Bypasses — standalone remote tools such as TeamViewer or 4G routers in the plant, which route around the jump server
• Passwords in scripts — credentials stored in plaintext batch scripts on workstations and servers; CISA still found this in 2025 during a threat hunt at a critical infrastructure organisation

🏭 How does a jump server fit IEC 62443 and NIS2?

IEC 62443 has no separate requirement for a jump server, but in practice the jump server is where many of its requirements come together:

In the zones and conduits model, the jump server is part of the conduit between the IT zone and the OT zones. In the Netherlands, the Cyberbeveiligingswet, the Dutch transposition of NIS2, has applied since 15 August 2026. International guidance points the same way: NIST SP 800-82 Rev. 3 (2023) places jump hosts in the DMZ between IT and OT, and the Secure Connectivity Principles for OT of January 2026, written by the UK NCSC, CISA, the Dutch NCSC and others, call for centralised, logged and time-limited access into OT.

❓ Frequently asked questions

What is the difference between a jump server and a bastion host?

A jump server and a bastion host are often used as synonyms in practice. Bastion host is the broader term for any specially hardened system on the edge of a network, whereas a jump server specifically serves as an intermediate hop for administrative sessions. In OT environments both terms usually refer to the same access point in the IDMZ.

Where do you place a jump server in an OT network?

A jump server sits in the industrial DMZ (IDMZ), at level 3.5 of the Purdue model, between the IT network and the OT zones. Firewalls on both sides ensure that IT can only reach the jump server and that only the jump server can reach the OT systems. For heavy engineering work, a second jump host is sometimes added inside the OT zone.

Is a VPN not enough for remote access to OT?

A VPN on its own is usually not enough for OT, because it gives the user access to an entire network segment without any view of what they do there. A jump server adds session control, logging, recording and restriction to specific target systems. That is why the VPN tunnel should preferably terminate in the IDMZ, with onward access going through the jump server.

Should a jump server use MFA?

A jump server should always enforce multi-factor authentication, preferably phishing-resistant using a hardware key or smartcard. Many PLCs and older SCADA systems cannot support MFA themselves, which makes the jump server the last place where you can enforce that control. IEC 62443-3-3 requires MFA for access via untrusted networks from security level 3, and NIS2 explicitly lists the use of MFA as a risk-management measure.

How do you give vendors secure access through a jump server?

Through a jump server, vendors get personal accounts, access only to their own equipment and only within a pre-approved time window. Their sessions are recorded and an operator can terminate the connection at any moment. IEC 62443-2-4 additionally requires the service provider to disclose every remote connection and obtain the asset owner’s approval in advance.

Can you copy files through a jump server?

File transfer through a jump server is a well-known risk, because it lets malware slip into OT unnoticed. Disable clipboard and drive mapping in RDP and route files through a separate, controlled transfer facility with malware scanning and logging. That keeps the jump server a management gateway rather than an uncontrolled data flow into OT.

📌 In summary

A jump server is the single, hardened access point in the IDMZ through which administrators and vendors reach OT systems, without any direct connection between IT and OT. With MFA, application allowlisting, PAM, session recording, controlled file transfer and its own identity domain, the jump server is a core element of a layered cybersecurity strategy and helps you demonstrate compliance with IEC 62443, ISO 27001, NIS2 and the Dutch Cyberbeveiligingswet, strengthening your overall OT security.