HashiCorp Vault is a secrets management platform designed to replace the pattern of static, long-lived credentials scattered across configuration files, environment variables, and CI pipelines with a centralised, policy-enforced, fully audited secrets API. Its core abstraction is that every secret has an identity (a path), an owner (determined by an auth method), a policy (an HCL HashiCorp Configuration Language document granting access to specific paths), and a lease (a TTL after which the secret expires or must be renewed). Nothing in Vault is persistent by default — every access is authenticated, every secret access is logged to an immutable audit trail, and credentials that are no longer needed expire automatically rather than accumulating indefinitely.
Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user’s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.
A bastion host (also called a jump server or jump host) is a hardened server placed at the boundary between a public network and a protected private network, through which all administrative access to internal systems must pass. Rather than exposing every server, database, or network device directly to the internet or to operator workstations, the network is designed so that only the bastion host has a publicly reachable address; internal systems accept SSH or RDP connections only from the bastion’s IP. An administrator who needs to reach an internal host connects first to the bastion — authenticating with a key, certificate, or MFA — and then hops onward to the target from there. The bastion’s narrow exposure makes it a concentrated target, which is why it receives disproportionate hardening: a minimal OS with only the necessary services running, strict firewall rules, aggressive patch cadence, and comprehensive session logging. The name comes from military fortification: a bastion is a protruding element of a castle wall designed to be defended at all costs.
