Field Notes
Working notes from the networks we build for — military commands, law enforcement, and emergency response. Why the focus exists, the architecture we deploy, and the failures we keep finding.
On a law enforcement or defense network, session records are evidence. What it takes for an administrative access record to survive an inspector general review or a defence challenge in court.
Read the note →Quarterly access recertification usually produces a spreadsheet, a deadline, and a wave of approvals nobody read. What has to change for the review to remove anything.
A confidence figure beside a plate read is not a probability that the read is correct. Understanding what it does measure changes how thresholds, BOLO alerting and evidence handling should be set.
Read accuracy is decided at the roadside, not in the software. Angle, distance, lane coverage, lighting and mounting height determine what the recogniser ever gets to see.
Most privileged access incidents involve an account that was legitimately granted and never taken away. Making access expire by default changes what an attacker finds when they get in.
Traffic patterns reveal trends, risks and recovery behaviour that a monthly total hides. Which four questions are worth instrumenting, and how to produce counts that survive a challenge.
What actually triggers a congestion alert, what the notice should contain, who gets told and when — and the tuning that decides whether an alerting channel is trusted or muted.
How corridor monitoring, AI analytics and secure infrastructure turn camera coverage into decisions — congestion called from evidence, alerts that respect the hours members chose, and counts that survive an audit.
Corridor systems produce two families of notification — routine operational alerts and watchlist matches. Treating them as one is the fastest way to get an alerting channel muted.
On a law enforcement or defense network, session records are evidence. What it takes for an administrative access record to survive an inspector general review or a defence challenge in court.
Access controls are designed for normal operations and judged during incidents. What surge access at an EOC activation actually demands, and why controls that get switched off during the event were never really controls.
Disconnected operation cannot be added to a product that assumed connectivity. What changes when licensing, updates, time, identity, alerting, and support are all designed for a network with no egress.
Commercial privileged access products carry a set of assumptions — a cloud control plane, a cloud identity provider, vendor remote support, licence phone-home — that a government or defense network cannot satisfy.
Every organisation calls its systems critical. Five practical tests that separate networks where privileged access must be brokered and recorded from networks where good practice is enough.
Vaultris works on military, law enforcement, and emergency response networks and nothing else. The reasoning behind that decision, what it changes in the product, and what we give up for it.
The recurring findings from privileged access assessments: bypass paths, agent forwarding, shared accounts, absent recording, and the controls that quietly stopped working.
kubectl exec is a shell, and a cloud console is administrative access with no protocol to proxy. How to bring both under the same gateway as SSH and RDP.
Which control families a bastion host actually satisfies, what evidence to produce for each, and the distinction between supporting a framework and being certified against it.
Credential injection means the gateway authenticates to the target on the operator’s behalf, so the password is never shown, typed, or known. What that changes, and what it does not.
Where the gateway sits determines what it can protect. Segmentation, the rules that make the chokepoint real, multi-site design, and placement for cloud and hybrid estates.
Third parties need administrative access and sit outside your identity system, your joiners-leavers process, and your control. How to grant it narrowly, record it fully, and expire it automatically.
Most organisations already have bastion hosts — undocumented, unpatched, and load-bearing. How to migrate to a governed gateway without an outage and without leaving the old path live.
A VPN grants network access; a bastion host grants a session. What each is good at, why the comparison is often framed wrongly, and when running both is the correct answer.
Every access control needs a documented way around it for genuine emergencies. How to build one that is available when everything is broken without becoming a permanent bypass.
Which bastion host events matter, how to structure them for correlation, the detections worth building, and why log volume is the enemy of actually noticing anything.
MFA at the gateway is the highest-value control on a bastion host, and the one most often undermined by exception groups. Factor choice, service accounts, and designing for the offline case.
Industrial networks cannot be patched on your schedule, and vendor engineers need access anyway. How a bastion host becomes the enforceable boundary between IT and operational technology.
Windows bastion hosts face a problem Linux does not: by default, RDP leaves reusable credentials in memory on the machine you connected to. Restricted Admin, Remote Credential Guard, and tiering.
If all administrative access flows through one host, its outage is an outage of your ability to fix anything. Active-passive, active-active, cross-site design, and the break-glass path.
Shell history is not an audit trail. What full session recording captures for SSH, RDP and web sessions, how recordings are sealed against tampering, and what retention actually costs.
A shared root or admin account collapses attribution at exactly the point you built the bastion host to establish it. Why shared credentials persist, and how to eliminate them without breaking operations.
ProxyJump, ProxyCommand, and agent forwarding compared. How to configure multi-hop SSH access so keys stay on the workstation and sessions stay attributable.
A concrete hardening baseline for a Linux bastion host: minimal install, SSH configuration, account policy, kernel and network settings, logging, and the drift problem nobody plans for.
The terms are used interchangeably, but they carry different emphasis. What each word implies about architecture, exposure, and how much control lives at the gateway.
A bastion host is a hardened intermediary host that administrators connect through to reach protected systems. How the architecture works, what it actually buys you, and where it falls short.
