When it comes to protecting a system that is critical, sometimes establishing a security zone needs additional configuration to make it function correctly. Two practices that are commonly used are to establish internal firewalls and stand up a jump box. A jump box is simply a system, usually a single operating system, that is connected to two networks. The first of these networks is the common network and the second is the sensitive security zone.
Jump boxes are usually used for a system tool that needs to connect directly to the devices on the security zone in question. A common example is a Windows system that is on the public network and a storage management network. The storage management network is the only network that has access to the storage area network (SAN) management interface. Frequently, storage systems are managed through tools that get security people uneasy. On the other hand, dual-homing systems is not a good practice either.
When a jump box is used, its hidden benefit is that any tools in place for the SAN system are maintained on that single system. Therefore, when an update to the SAN management software is available, only a single system requires the update. Beyond SAN management systems, this practice is done occasionally in virtualization circles. The VMware vCenter Server Windows system in particular is occasionally used in a jump box configuration.
In today’s world, is a firewall or a jump box the better option ? From an application side, the single system running the SAN management software (or vSphere Client) appeals for a few reasons. Primarily, there would be no systems (presumably laptops) with access to these tools and possibly this security zone that could come up missing. Secondly, the limited update footprint is attractive for any version-critical application.
From the security side, the jump box becomes a target, and in theory, would be easier to compromise than a true firewall. Even if a software firewall was running on the jump box system, I’m sure someone would knock that approach.
What is your stance on jump boxes? Share your comments below.
