What is a Break Glass Account?

In the world of IT management and cybersecurity, terms often come up that may sound a bit mysterious at times, but play a crucial role in system security. One such term is the “Break Glass ” account. But what exactly is it, and why is it so important?

What is a Break Glass Account?

A Break Glass account is a special administrator account that provides access to critical systems in the event of failures or security incidents. This account acts as a “sledgehammer,” so to speak, which you use to gain access to systems when other access methods fail. Consider situations where:

• A major security incident occurs.
• There is a malfunction in the systems that normally grant access.
• MFA (Multi-Factor Authentication) is unavailable.

MFA Mandatory for Administrators from October 15

It is important to know that as of October 15, MFA is mandatory for all administrator accounts. This means that administrators can only gain access to systems through an extra layer of security, such as a code sent to their mobile device. This measure is intended to further strengthen the security of critical systems and minimize the risk of unauthorized access.

Although MFA is essential, there are situations in which MFA services are unavailable or in which rapid access to systems is required without delay. In such cases, a breakglass account is crucial, as it provides access without the need for MFA, while still adhering to strong security measures such as strong passwords and the use of FIDO2 keys.

Why Is a Break Glass Account Important?

Having a Break Glass account is not a luxury, but a necessity for any organization that takes cybersecurity seriously. Here are a few reasons why this account is essential:

• Access in emergencies: When regular access methods fail, the BreakGlass account always provides a backdoor to manage critical systems.
• Minimal downtime: By ensuring access at all times, the time systems are unavailable is minimized.
• Security incident management: In the event of a cyberattack, a BreakGlass account enables administrators to respond quickly and effectively.

How does a Break Glass Account work? ⚙️

A Break Glass account is usually configured differently from other administrator accounts:

• MFA Disabled: MFA is often disabled for this account to ensure access at all times, even when MFA services are unavailable.
• Strong Passwords: The account has a very strong and unique password that is regularly reviewed and changed.
• Limited Use: The account is used only in emergency situations, and access is closely monitored and logged.
• Use of FIDO2 Keys: Although MFA is often disabled for breakglass accounts, the use of FIDO2 keys can add an extra layer of security without relying on traditional MFA methods. These keys provide strong, hardware-based authentication that is difficult to bypass.

Best Practices for Break Glass Accounts

When setting up a Break Glass account, there are a few best practices you should always follow to ensure security:

• Documentation: Provide clear documentation on when and how the account may be used.
• Monitoring: Closely monitor all attempts to access the account.
• Regular audits: Conduct periodic audits to ensure that the account still meets security standards.
• Restricted access: Ensure that only a limited number of trusted individuals are aware of the existence of the BreakGlass account and its login credentials.
• Exclusion from Conditional Access: Ensure that the Break Glass account is excluded from all conditional access policies. This is crucial to ensure that the account remains accessible at all times, even when there are issues with conditional access.

Why Exclude Break Glass Accounts from Conditional Access? ❌

Break Glass accounts have a specific purpose: providing guaranteed access to critical systems in emergency situations. Subjecting these accounts to conditional access can undermine the account’s intended purpose. Here are some reasons why excluding Break Glass accounts from conditional access is best practice:

• Always-On Access: Excluding “Break Glass” accounts ensures that these accounts always have access, regardless of circumstances such as location, device usage, or risk level.
• Avoiding Lockout: Suppose there is an issue with conditional access, such as a configuration error or a service outage that affects the enforcement of these policies. In that case, a Break Glass account covered by these policies would also be locked out, which defeats the purpose of the account.
• Unrestricted Emergency Access: In an emergency, speed is crucial. Excluding “Break Glass” accounts from conditional access prevents unnecessary delays and ensures that administrators can act quickly.

Conclusion ️

A breakglass account is a crucial component of a robust IT security strategy. It provides a last resort in situations where access to critical systems is at risk of being lost. By setting it up correctly, excluding it from conditional access, considering the use of FIDO2 keys, and following best practices, organizations can ensure they are prepared for any emergency.

At ALTA-ICT, we use FIDO2 keys in all of our modern workplace packages to ensure that our customers always have access to their critical systems, even in emergency situations. This enhances the security and reliability of our solutions, ensuring that your organization remains well-protected against unexpected events.

As an IT administrator or security professional, it is advisable to consider implementing a “break-glass” account within your organization. It is better to be prepared for the unexpected than to have to react to a crisis after the fact.

Need Help?

Is your organization facing challenges, or do you need additional support? We’re here to help and will make sure everything is handled correctly and on time! Visit our contact page and get in touch with us.

A “break glass” account is one component of a well-configured tenant. Learn how ALTA-ICT approaches Microsoft 365 security.