Break-glass access should be exceptional and noisy
Every environment needs a way in when the normal route is broken. That account should be almost never used and impossible to use quietly.
The danger is a break-glass account that gets used routinely because it is easier, at which point it is just an administrator account with weaker oversight. Used properly it should set off alarms, notify people, and require an explanation afterwards. The noise is the control: it is what stops the exception quietly becoming the norm.
More on Authorisation and privilege
- Least privilege decays over timeNobody hands the old one back
- Privilege boundaries matter more than job titlesRead the account, not the business card
- Permission inheritance can hide excessive accessGranted upstairs, arrives downstairs
- Wildcard permissions widen blast radiusOne character, a much bigger circle
- Deny rules can create hard guardrailsOne no ends it
- Admin tools are part of the privileged access pathThe hand is not on the system