<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">
Attending AWS re:Invent? Let's meet in person! Book a meeting

StrongDM: Breaking Glass Scenarios

StrongDM manages and audits access to infrastructure.
  • Role-based, attribute-based, & just-in-time access to infrastructure
  • Connect any person or service to any infrastructure, anywhere
  • Logging like you've never seen

Let’s face it. If you work with any type of technology, you know that all software, hardware, and networking gear can fail in weird and unexpected ways. That’s why it’s critical that your technology stack has no single point of failure in your environment.

At StrongDM, that means having options in a break glass” scenario. We firmly believe that this is a requirement for the responsible operation of modern technology. So here’s how we tackle it.

StrongDM is a proxy that combines authentication, authorization, networking, and observability into a single product. As such, StrongDM makes it easy to maintain secure access and auditing for your workflows with fail-closed if we can’t authenticate you with our control plane (which you want for security reasons).

In the case that this happens, whether due to a misconfiguration or other issue, you would still need some level of access to your key infrastructure. That’s why StrongDM doesn’t lock you out of creating “break glass” emergency access.

How to Break Glass with StrongDM

Understanding how to break glass when using StrongDM requires a few very simple steps. The process is focused on creating accounts specifically for a break-glass scenario, protecting those accounts, and ensuring that access to those accounts is closely monitored. Here’s how:

  1. Implement a Break-Glass Account: Create a limited-access "break-glass" account with highly restricted privileges that can be used only during emergencies. This account should have a complex, unique password and be stored securely offline, accessible only to authorized personnel, such as the IT security team or senior management.
  2. Define Clear Access Policies: Develop a comprehensive set of policies and procedures for emergency access. Specify the circumstances under which the break-glass account can be used, the process for requesting access, and the necessary approvals.
  3. Multi-Factor Authentication (MFA): Enforce multi-factor authentication for the break-glass account to add an extra layer of security. This can include something the user knows (password), something the user has (smartphone or token), and/or something the user is (biometric data).
  4. Limited Time Window: Restrict the usage time window for the break-glass account. Once the emergency is resolved, disable the account immediately.
  5. Audit and Monitoring: Implement robust logging and monitoring to track all activities performed using the break-glass account. This helps in post-incident analysis and ensures accountability.
  6. Regular Testing: Conduct periodic testing and drills of the emergency access procedure to ensure that all involved parties understand their roles and responsibilities. This helps identify and address any potential issues before an actual outage occurs.
  7. Secure Offsite Backup: Maintain a secure offsite backup of essential PAM-related data, configurations, and credentials. This will allow a faster recovery in the event of a PAM system failure.
  8. Communication Plan: Develop a clear communication plan to inform stakeholders and authorized personnel about the PAM outage, the emergency access procedure, and any other relevant details.
  9. Continuous Improvement: Regularly review and update the emergency access procedure based on lessons learned from previous drills or incidents. Continuous improvement is vital for maintaining a robust and resilient security posture.

Additional Considerations

Depending on your environment, there are additional actions you can take to ensure you’re prepared for the worst and to increase the security of your break-glass credentials.

On-premises environments: If the majority of your infrastructure is hosted on-premises, you do  have the option to store credentials on a hardware key, such as a Yubikey. You can also store the physical key in a physical vault, providing an additional layer of security.

Cloud environments: In the case that your environment is primarily based in the cloud, there are additional considerations you may want to take. For example, you could:

  • Prevent the use of cloud consoles through organization-wide Service Control Policies (SCPs) for each cloud provider
  • Alert on attempts to use cloud consoles outside of emergency situations
  • In an emergency situation, temporarily remove those SCPs, and use the cloud provider’s console to access the machine 


Regardless of your environment, having and testing a break glass scenario and technology provides options in the case of an emergency should be a core requirement in your IAM and PAM deployments. StrongDM takes these situations seriously and we’re committed to your success even when the worst happens.

See StrongDM in action, book a demo.

About the Author

, Senior Marketing Director, has held marketing leadership roles for Silicon Valley technology companies specializing in database, data management, and data analytics solutions. As head of content marketing at Splunk, Dominic contributed to boosting the company’s market visibility and its growth from a $100M to a $1.3B company. He brings relentless creativity to the task of connecting people with technical products to improve their lives. Dominic holds a B.S. degree in Public Relations from the University of Texas at Austin. To contact Dominic, visit him on LinkedIn.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

AWS Well-Architected Framework Security Best Practices
AWS Well-Architected Framework Security Best Practices
The AWS Well-Architected Framework has been a staple for many years for AWS practitioners of all sorts, including cloud architects and platform engineers. It’s a blueprint for architectural and design best practices that will lay the foundation for resilience, operational efficiency, and security on the AWS Cloud.
Fine-Grained vs. Coarse-Grained Access Control Explained
Fine-Grained vs. Coarse-Grained Access Control Explained
If credentials fall into the wrong hands, intruders may enter a network and launch a disastrous attack. In fact, 46% of cybersecurity incidents involve authentication credentials, according to the Verizon 2022 Data Breach Investigations Report. Organizations have two general ways to determine someone’s access rights once past initial authentication: Coarse-grained access control (CGAC), which relies on a single factor, and fine-grained access control (FGAC), which relies on multiple factors. Traditionally, CGAC has been the easier option, while FGAC offers superior security at the cost of more complex implementation.
MITRE ATT&CK Framework Containers Matrix for Kubernetes
MITRE ATT&CK Framework Containers Matrix for Kubernetes
If you’re Kuberntes admin and you’re not familiar with the tactics outlined in the MITRE ATT&CK framework, this blog post is for you. MITRE ATT&CK framework is an extensive knowledge base of tactics and techniques employed by bad actors that defensive security experts use to help defend their organizations against attack, and many times, used by their offensive security counterparts to test their weaknesses.
Unlocking Zero Trust: The Kipling Method for Policy Writing
Unlocking Zero Trust: The Kipling Method for Policy Writing
To embark on a successful Zero Trust journey, it's crucial to articulate and implement policies that align seamlessly with your business model. The Kipling Method serves as a guiding light in this endeavor. Let's delve into the six fundamental questions it poses.
Simplifying AWS Access with StrongDM Without Compromising Security Posture
Simplifying AWS Access with StrongDM Without Compromising Security Posture
Since Amazon Web Services first announced it in 2011, AWS IAM has evolved to become the gateway to the AWS Cloud. Organizations cannot interact with their cloud resources and its many services without it. Identity, not networking, is the real access boundary.