When deploying an access management solution, like a privileged access management (PAM) tool, businesses often require a “back-up” access capability that would allow a user or users to access their system even in case of an emergency, when the deployed PAM tool is unavailable to provide access in a regular way. This type of emergency access is called break-glass access.
Contents
What is Break-Glass Access?
When Might You Need Break-Glass Access?
How to Manage Break-Glass Access?
What is Break-Glass Access?
Break-glass access refers to a procedure used in critical emergencies or exceptional cases, when a user with insufficient access is granted elevated access rights to bypass normal access controls. The user then gains immediate access to accounts or targets that they wouldn’t normally be authorized to access with the aim of performing emergency tasks, which they wouldn’t perform during regular, day-to-day operations.
Break-glass access is granted through a dedicated break-glass account which is traditionally created in advance. The account is typically highly privileged and allows access to the most critical systems, like root accounts. For that reason, break-glass accounts are well monitored, documented, tested, and managed to avoid any misuse. The related break-glass credentials that allow access to the account are typically quickly available to prevent unnecessary delays and have a time duration limit, which helps to control and reduce the account usage to certain tasks only.
When Might You Need Break-Glass Access?
An emergency break-glass access should be used only in situations when normal procedures are insufficient or unavailable. For example:
-
The deployed PAM tool is unavailable due to excessive downtime or maintenance.
-
PAM tool failure – the authentication process fails due to the server being down.
-
Multi-factor authentication (MFA) is required but unavailable due to a network outage.
-
Account problems due to a cyberattack – access to all accounts was removed.
-
Account problems due to a locked password – the password was typed incorrectly too many times.
How to Manage Break-Glass Access?
The traditional way to manage break-glass access is via a PAM tool. Traditional PAM tools offer the functionality to create, monitor, and manage break-glass accounts, but their capabilities are limited and dependent on the operationality of PAM tools.
In most scenarios, managing break-glass access through a PAM tool is enough. However, problems arise during a PAM tool failure or unavailability – when one of the PAM tool components (a stronghold or password vault) becomes inoperable. This results in the inability of the PAM tool to provide regular as well as break-glass access. Like this, the deployed PAM tool basically becomes a single point of failure.
The solution to the PAM failure problem is implementing an access management solution that is capable of utilizing more than one way to access targets, even when break-glass access is needed.
For example, SSH’s Zero Trust Suite implements the modern way of managing break-glass access in two forms:
- By using encryption keys
- By eliminating passwords and password vaulting
Learn more about managing break-glass access in a modern way by using encryption keys or by eliminating passwords in the whitepaper below:
Learn why you are better without password vaulting in this blog post >>>
