XoT compared with a jump server
A shared server or a Lock at the equipment
A jump server is a server that all remote access passes through. It gives you an overview. But it also becomes a valuable target for attackers, because it reaches many machines.
The differences point by point
| Property | Jump server | XoT Remote Access |
|---|---|---|
| How the user connects | Through the same server as everyone else | Through XoT Bridge to the equipment that the authorisation covers |
| If a user is attacked | The attacker reaches whatever the user reaches through the server | The attacker only reaches the equipment that the user has an authorisation for |
| Authorisation per machine | Through rules on the server | Part of the authorisation |
| A site elsewhere, over the internet | Requires a way in to the server | Works, and no inbound ports need to be opened |
| Login | Often a username and password | Certificate, with no passwords |
| Log | Depends on how the server is configured | Who, to what, from where, when and for how long |
Where the difference shows
Why the jump server is a target
A jump server is the server that reaches the most other machines. That makes it the most valuable target for an attacker. It is usually well protected, but the risk is still concentrated in one place.
The server also has its own operating system that must be updated. It has services running and accounts that must be managed.
With XoT, each user connects through XoT Bridge to the equipment that the authorisation covers. XoT Bridge relays the traffic, but the traffic is encrypted all the way between the user and the Lock. The Lock in front of the equipment only lets through someone with a valid Key.
Fair to the jump server
What the jump server does well
A jump server can often record what is done during a session, not just that the session took place. If you need that level of detail, check that the solution you choose can provide it.
A jump server also gives you one place to gather rules, approvals and password changes. And many vendors already know the technology.
We are not against jump servers. But a jump server should not be the only protection between a vendor and the whole plant.
Common questions
Can we use both a jump server and XoT?
Yes. For example, you can keep the jump server for internal workflows and use XoT for external vendors.
Can the vendor connect without installing anything?
Yes. With XoT, the vendor can connect through a web browser. There is also an application for Windows, macOS and Linux.
Can we require approval before a vendor gets access?
Yes. The vendor can request access in a self-service portal. The person who approves the request receives an email.
Compare in your own environment
Choose a machine that people reach through the jump server today. Put a Lock in front of it and compare.