Skip to main content

Scenario S-007 - Compromise of bastion access platform

ElementDescription
Scenario IDS-007
Target assetTeleport Bastion providing centralized administrative access to infrastructure
Threat sourceExternal attacker or malicious insider
Attack vectorStolen credentials or bypass of multi-factor authentication mechanisms
Potential impactBroad administrative access to infrastructure systems enabling unauthorized management actions
Likelihood🟨 Medium - credential theft and MFA bypass attempts are common attack techniques targeting access gateways
Impact rating🟥 High - compromise of the bastion host can expose multiple systems to administrative takeover
Risk rating🟥 High

Mitigation:

  • Enforce strong authentication with mandatory multi-factor authentication.
  • Restrict bastion access to trusted networks or VPN endpoints.
  • Apply role-based access control to limit administrative privileges.
  • Enable session recording and audit logging for administrative activities.
  • Monitor authentication events and access anomalies via centralized logging and SIEM.

Owners:

  • Ops - bastion infrastructure deployment and maintenance.
  • Sec - access policies, monitoring rules, and audit review.

References:

  • ISO 27001 - Control 8.2 Privileged access rights.
  • ISO 27001 - Control 8.3 Information access restriction.
  • ISO 27001 - Control 8.16 Monitoring activities.
  • NIST CSF - PR.AC Access Control.
  • NIST CSF - DE.CM Continuous Monitoring.
  • NIST CSF - PR.PT Protective Technology.
  • EBIOS RM - Threat scenarios targeting bastion platforms and privileged access compromise.

Response actions:

  • Containment - Immediately disable compromised accounts and restrict bastion access.
  • Eradication - Reset affected credentials and investigate authentication logs to determine intrusion vector.
  • Recovery - Re-establish secure bastion configuration and validate integrity of administrative access policies.
  • Post-incident - Conduct access reviews, strengthen authentication mechanisms, and update monitoring rules.