1. The bypass path nobody closed
A gateway is deployed and everyone starts using it, but the firewall rules permitting direct administrative access from the old admin subnet are never removed. The chokepoint exists by convention. Test it from an ordinary workstation — if a direct connection succeeds, nothing else on this list matters yet.
2. Agent forwarding left enabled
Convenient, and it means anyone with root on the gateway can use every connected operator’s private key against anything it will open. Use ProxyJump, which keeps the key on the workstation. See ProxyJump configuration.
3. Shared accounts at the far end
Perfect gateway, full recording, and the session record says the connection was made as oracle — an account eleven people know. Attribution ends there. Fix the last link in the chain.
4. Shell history mistaken for an audit trail
It is editable by the person under investigation, captures no output, misses non-interactive commands, and is lost when a session is killed. It answers none of the questions asked during an incident.
5. Access that never expires
A contractor granted access for a two-week engagement is still in the group three years later, because nothing removed them. Expiry has to be a property of the grant, enforced by the system — not an action someone remembers to take.
6. The gateway runs other things
A monitoring agent, a small internal web app, someone’s scripts. Each addition is attack surface on the one host that must not fall. The gateway does the gateway function and nothing else.
7. Recording that silently stopped
Storage filled, a service failed, or an upgrade changed a default, and sessions have not been captured for six weeks. Nobody noticed, because nothing checks. Worse than no recording, because everyone believes it is running. Run a scheduled integrity and coverage report.
8. No tested failover
An HA pair exists on the diagram and failover has never been performed. The first real test happens during an incident, and it is when everyone discovers the standby has stale entitlements or cannot reach the vault. Design and drill it.
9. Break-glass that became routine
The emergency path is used monthly, alerting on it was muted because it fired constantly, and it is now a team’s standard route. If break-glass is used often, the normal path is failing a legitimate need — widen the normal path rather than formalising the bypass.
10. Privileged access outside the gateway entirely
SSH and RDP are governed. Meanwhile the cloud console, the Kubernetes API, the storage array’s web interface, and the out-of-band management network are all reachable directly with credentials in a shared vault. The programme covered the access paths that existed when it started. Bring the rest in.
How to use this list
Work down it in order — it is roughly ordered by how much risk each finding carries relative to the effort of fixing it. Items 1 and 3 are usually the largest single improvements available, and neither requires new software.