Emergency break-glass admin accounts for the city identity platform are used weekly for routine changes and generate no alerts. What redesign is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Break-glass is the fire axe behind the glass—not the everyday screwdriver. Keep it rare, loud with alerts, and sealed; use normal JIT admin for Tuesday chores.
Full Explanation
Break-glass (emergency) administrator accounts exist for identity-platform lockout and true crises, not for weekly routine changes. They must remain exceptional, vaulted, dual-controlled where feasible, and continuously monitored so each use fires high-priority alerts and a mandatory post-use review. Routine work should flow through normal just-in-time privileged access; redesign that reserves break-glass for emergencies restores the control’s meaning and detection value for the city IdP.
Issuing break-glass passwords to every help-desk contractor for speed converts an emergency control into standing shared privilege and virtually guarantees undetected misuse. Storing credentials only in a public wiki maximizes exposure to anyone with intranet read access. Eliminating all privileged accounts, including emergency ones, may leave the municipality unable to recover from IdP or directory failure—availability without a governed emergency path is also a risk.
Exam caveat: break-glass without monitoring is merely a hidden standing admin; look for rarity plus alerting plus JIT for routine work. Operational check: move emergency secrets into a PAM vault with check-out, page security on every use, require incident tickets within hours, sample whether “weekly” use has stopped, and test restore procedures so on-call staff know the real emergency path.