Break-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a real incident.
Break-glass accounts fail in two directions. Untested, they do not work during the outage they exist for, usually because they depend on the SSO or MFA service that is down. Untested and unmonitored, they become a standing backdoor that nobody notices being used. The rule that survives audit is: excluded from conditional access, credentials split and vaulted, every use alerts immediately, and the whole path is exercised on a schedule.
See also: what is PAM, zero standing privileges, just-in-time access, PAM vendors, local login bypass, SSO enforcement
Related on Start with Identity
- GlossaryShared Account
A shared account is a single set of credentials used by more than one person, or by a function rather than a person, such as a team mailbox, a kiosk or front-de
- GlossaryStanding Privilege
Standing privilege is elevated access (an admin role, a privileged group membership, a cloud owner permission) that an account holds permanently, whether or not
- GlossaryCredential Brokering
Credential brokering is the pattern in which an intermediary fetches a credential from a vault or credential store at the moment of access and hands it to an al
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- CVEBeyondTrust PRA and Remote Support unauthenticated command injection
Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning