Break Glass
What is break glass?
Break glass is a method of bypassing the security controls that normally guard a system or service. The term comes from breaking the glass cover to pull a fire alarm. It's for the moment when a user can't gain authorized access the way they normally would.
Break glass lets a user bypass their organization's identity and access management (IAM) or privileged access management (PAM) solution and regain access when normal sign-in fails. A dedicated, pre-staged break-glass account is created as a backup for emergencies.
The break-glass account is highly privileged; it can reach critical systems, such as root accounts. Break-glass accounts are typically monitored, tested, documented and managed to prevent inappropriate use. Break-glass credentials have a limited lifespan to restrict use to emergencies or other unusual events and avoid mishandling.
When is break glass used?
PAM and multi-factor authentication (MFA) involve rigid rules designed to say no to unauthorized users and cyber criminals. But those same controls can lock out legitimate users, which can hurt business continuity and emergency response. In some industries, such as healthcare or disaster management, a lockout can put lives or property at risk. A cyberattack that disables or locks administrator accounts can also slow the responders trying to stop it.
Break glass is the way back in when it's the only route to systems and applications, for example when:
- the organization's PAM tool is unavailable because of downtime or maintenance, or its authentication process fails because the server is down.
- MFA is unavailable because of a network outage.
- a cyberattack, such as a DDoS attack on the identity provider, blocks normal sign-in.
- a PAM or MFA safety feature locks out a user after too many wrong passwords.
- a user locks themselves out of a tenant with conditional access policies.
- federation services fail.
- a service outage blocks normal authentication.
How a break-glass process works
A break-glass process is planned, managed and audited in advance so that emergency access is fast to grant, hard to abuse and easy to reverse.
Setting up break-glass accounts
An organization first decides who can request emergency access and under what circumstances. It then creates pre-staged break-glass accounts with the admin rights needed to recover access. These accounts are excluded from policies that could lock them out, such as conditional access rules that depend on a system that might be down, and they do not depend on a federated identity provider. They still require strong authentication that works when those systems are down, such as a hardware security key.
Most organizations set up one break-glass account per platform, and some add a second as a backup. An emergency account manager, either a named person or an on-call group, holds the credentials and releases them only after verifying the requester's identity.
Using a break-glass account
A break-glass procedure typically has four steps:
- A user who is locked out requests break-glass access, for example during a service outage, a DDoS attack on the identity provider or a task they are not normally authorized for.
- The emergency account manager verifies the requester's identity, records it for auditing and releases the credentials. Some organizations also require pre-approval at this step.
- The requester uses the account to regain access.
- The organization reviews the session for inappropriate or suspicious activity, rotates the account's credentials and returns the account to its secured, unused state. An account created only for the incident is deleted or disabled.
Where the credentials are kept depends on the environment. On-premise organizations may store them on a hardware key in a physical safe. Cloud-based organizations use the provider's own recovery path; in AWS Organizations, for example, an administrator in the management account can temporarily detach a service control policy (SCP) that is blocking access.
The break-glass path must keep working when the tool it bypasses is down, so it should never depend on that tool. IAM and PAM tools still support the process: they can vault the emergency credentials, alert on their use, keep an audit trail and rotate the credentials after each incident.
More resources
Blog
