Review Break-Glass Access
Define emergency access triggers, short expiry, independent approval, audit events, and a post-use review before an incident.
Emergency access is useful only when it can be activated during an incident and removed afterward. A permanent admin account labeled "break glass" is simply standing privilege. Define the trigger, allowed systems, approval path, time limit, and review owner before anyone needs the account.
OWASP's authorization guidance favors least privilege and explicit decisions. Emergency access is an exception to normal workflow, not an exception to accountability. Keep the credential or grant outside ordinary developer sessions. Do not include its secret in a shared runbook.
Emergency grant record
| Field | Required entry |
|---|---|
| Trigger | Incident or outage that justifies the grant |
| Requester | Named authenticated operator |
| Approver | Independent person or documented fallback |
| Scope | Exact system, role, and permitted actions |
| Start and expiry | Short bounded window |
| Audit | Grant, use, and removal event IDs |
| Review | Post-use owner and deadline |
The grant should expire automatically where the provider supports that behavior. If it does not, schedule a separate removal check with a second operator. A lockout during an incident can be as harmful as an uncontrolled grant, so test the recovery path with an owned account and no customer data.
Drill the lifecycle
Run a controlled exercise. Request access for a synthetic incident, approve it, perform one harmless operation, and verify the action appears in a protected audit record. Let the grant expire or revoke it, then try the same operation again. It must fail. Test a missing approver, an out-of-scope action, and a duplicate request. Record the exact provider-side status after removal.
Keep an alternate path for an unavailable approver, but do not make it a hidden permanent bypass. Document who can invoke it and how quickly a later review happens. A drill that succeeds at activation but never proves removal is incomplete. Reconcile emergency accounts in periodic access reviews so dormant grants do not accumulate. An emergency mechanism does not authorize a security assessment of systems outside the team's written scope.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.
Sources
- OWASP Authorization Cheat SheetAccessed
- OWASP Logging Cheat SheetAccessed