PAM break-glass: group, alerts and review

Break-glass lets the officers of a restricted group reach any privileged account during an incident, without the normal approval path, but with a second officer's confirmation, full recording and a mandatory review.

How do I set the group?

1. Under «Manage» › «Groups», create a group with the officers (at least two active members).
2. Under «PAM» › «Break-glass», pick it in «Break-glass group». «None (break-glass off)» turns the feature off.
3. Choose «Ask a second administrator». Setting the group is always four-eyes.

The console shows how many active officers there are.

How does a break-glass access run?

1. An officer requests it (up to 60 minutes, an incident reference, a justification of at least 20 characters).
2. Another officer confirms with a passkey within 15 minutes.
3. The requester activates the access, also within 15 minutes.
4. Officers and administrators are emailed on request and confirmation.
5. At the end, the credential is rotated.

Break-glass requests do not go through the normal approvers or the phone.

The review

Each access opens a review due within 72 hours («Review due»). An administrator who is not an officer:

1. Opens the access in the list.
2. Chooses «Justified» or «Not justified» and writes the «Review notes (optional)».
3. «Review recorded.» appears.

When reviews are overdue, the console warns and a daily reminder email is sent.

Good practice

• Keep the group small and reviewed.
• Treat every «Not justified» access as a security incident.