What is a break-glass account?
A break-glass account is a privileged account reserved for emergencies in which normal ways of signing in no longer work. It exists so that administrators can still reach critical systems when the identity provider, the multi-factor service or the directory is down or compromised.
Why do backup systems need a break-glass account?
Backup systems are needed most when other things have failed. If the backup console and the storage management interface accept only accounts from the production directory, then losing that directory, to an outage or to ransomware, locks administrators out of the very systems meant to restore it. A local emergency account, independent of the directory and of any external authentication service, keeps a way in.
How is a break-glass account protected?
The account is powerful and rarely used, which makes it attractive to attackers and easy to forget. Its protection relies on a few firm rules.
| Control | Purpose |
|---|---|
| Long, random password stored offline | Cannot be phished or taken from a password manager that is itself down |
| Split knowledge or sealed envelope | No single person can use it unnoticed |
| Local to the system, not in the directory | Works when the directory does not |
| Alert on every sign-in | Any use is seen immediately |
| Password changed after each use | A disclosed password has a short life |
| Regular test | Confirms the account still works |
How does it relate to MFA and four-eyes controls?
Emergency accounts are often exempt from multi-factor authentication, because the second factor may depend on a service that is unavailable. That exemption is acceptable only if the other controls hold: offline storage, split custody and immediate alerting. Where possible, a hardware key kept with the sealed password restores a second factor without an online dependency. The four-eyes principle applies naturally, since two people should be needed to retrieve the credentials.
What should a break-glass account not be able to do?
Emergency access is for recovery. It should not be a way around data protection. If backups are locked in compliance mode, the break-glass account cannot delete them either, and that is intended. This matters because a stolen emergency credential would otherwise be the most direct route to destroying backups. Designing the account so that it can restore service but cannot remove immutable data keeps the administrative blast radius bounded.
Frequently asked questions
How many break-glass accounts should there be?
Usually one or two per critical system, so that a single lockout or lost envelope does not remove emergency access.
Where should the password be kept?
Offline, in a safe or sealed envelope under dual control, with a copy at a second location.
How often should a break-glass account be tested?
At least once or twice a year, and after any change to authentication on the system it belongs to.