Simple zero-trust access for dynamic cloud environments.
No single point of compromise.
BastionZero is the most secure way to lock down remote access to servers, containers and clusters in any datacenter or public cloud.
Bastion hosts are a security best practice for remote access to targets in the cloud.
Bastions are gate keepers to your cloud infrastructure, allowing you to:
Control access to targets (servers, containers and clusters)- Log the activities of your engineers and their scripts
- Satisfy compliance (e.g AWS Best Practices, SOC2 Type 2, ISO27001)
- Stop users on insecure OSes from directly accessing your targets
- Avoid giving users long-standing SSH keys to targets
But if you're not careful, your bastion host can also be a giant security flaw.
Traditional bastions are a single point of compromise in your cloud.
- Home-grown bastions hold the SSH keys to all your targets. If the Bastion is hacked, all of your targets are compromised.
- Traditional zero-trust network architectures use an all-powerful centralized authority to provide users with short-term credentials to targets. But if that centralized authority is hacked, all the targets are compromised.
Attackers love to target single point of compromise. Do you really want to put all the keys to your kingdom in a single place? No, you don't.
BastionZero provides zero-trust access to your cloud, without creating a single point of compromise.
BastionZero uses unique key-splitting technology to provide all the benefits of zero-trust, without needing to store all of your credentials in an all-powerful centralized authority. Instead, credentials are split between a user and BastionZero. This means that BastionZero cannot access your servers without the consent of a valid user in your organization. You can rest easy because a compromise of BastionZero does not lead to a compromise of your servers.
Improved security, minimal effort.
BastionZero deploys in minutes, autodiscovers your targets and automatically integrates with your IdP.
There is no need to build or maintain a custom server or open-source software.
Target Autodiscovery
Configuring long-lived SSH keys for short-lived targets or infrastructure as code can be tricky to manage and secure. But with BastionZero, no SSH keys are required. Instead, your targets are autodiscovered by BastionZero as they spin up and down.
SSO Integration
Each user SSOs into BastionZero via your existing Identity Provider (IdP), and requests access to a target. BastionZero applies a policy check. If access is granted, the user is connected to the target and her access and commands are immutably logged.
No New Infrastructure
BastionZero uses a single policy-based access control engine to manage targets in all of your clouds and environments. And BastionZero is a SaaS, which means that you never have to provision, maintain, upgrade or patch it.
Immutably log who ran what command on what target.
If an adversary compromises your servers, they can cover their tracks by deleting any logs stored at the server. BastionZero eliminates this attack by intercepting and logging all commands before they reach the server. That way, an adversary can’t hide their actions by deleting server logs. And you you can satisfy your compliance and forensics requirements with high-quality immutable logs.
Early access!
Interested in using BastionZero to control access to your infrastructure? Request early access!
