Break-glass accounts: the exception that becomes the breach

Every environment needs a way in when everything else fails. Every environment I've seen has at least one such account that's been used for something other than an emergency.

The failure pattern

The break-glass account is created carefully. Then the MFA provider has an outage, someone uses the account to fix it, and afterwards it's just easier to keep using it. Six months later it's in a script. A year later nobody's sure how many people know the password.

What good looks like

• It's sealed, and opening it makes noise. Retrieving the credential triggers an alert to people who weren't involved in retrieving it.
• Every use is an incident. Not a security incident necessarily, but a recorded event with a reason, a time, and a review afterwards.
• It's rotated after every use. No exceptions. If that's painful, the account is being used too often, which is the actual finding.
• It can't do everything. Enough to restore identity services; not enough to quietly exfiltrate the finance share.
• It's tested. Twice a year, someone proves it still works, because the one you've never tested is the one that fails during the outage.

The question for your team

How many accounts in your environment can bypass MFA, and when was each last used? If the answer takes more than a day to produce, the accounts exist but the control doesn't.

Why attackers love these

They're high-privilege, exempt from the strongest control, and rarely monitored. That's the profile of a perfect target. Treat them accordingly.

If you want an honest look at your privileged and emergency access, that's a short engagement with a long payoff.

Explore: More on identity and zero trust · Work with me