Break-Glass Procedure

The core mechanism that grants temporary, time-bound administrative access to a locked-down system. Unlike standing privileges, break-glass accounts remain disabled until a strict activation workflow is triggered. The elevation is tied to a specific ticket or incident ID, and the credentials are automatically rotated or disabled immediately after the predefined time window expires. This minimizes the attack surface by ensuring no permanent backdoor exists.

Also known as split-knowledge or M-of-N control, this characteristic requires multiple authorized individuals to simultaneously authenticate or approve the glass-break before access is granted. Common implementations include:

• Dual Key Encryption: Two separate cryptographic keys held by different operators must be combined.
• Out-of-Band Approval: A push notification requiring biometric confirmation from a secondary security officer. This prevents a single compromised insider or rogue administrator from unilaterally accessing sensitive air-gapped systems.

Every action taken during a break-glass session is captured in a tamper-proof, append-only log. This includes keystroke-level logging, screen recording, and API call capture. The audit trail is streamed to a separate, hardened security information and event management (SIEM) system that the break-glass operator cannot access or modify. This ensures non-repudiation, allowing security teams to reconstruct the entire incident timeline and verify that the emergency access was not misused.

Immediately upon the expiration or termination of the break-glass session, the system triggers an automated workflow to invalidate and rotate the exposed credentials. This process revokes the temporary certificates, regenerates the compromised private keys, and updates the offline hardware security module (HSM) with new material. The rotation ensures that any credentials potentially observed or exfiltrated during the emergency session become cryptographically useless, restoring the system to its fully hardened state.

The break-glass system integrates with policy as code (PaC) engines to evaluate the context of the emergency before granting access. The admission controller checks dynamic attributes such as:

• Geolocation: Is the request originating from the secure facility?
• System Health: Is there an active P1 incident alert?
• Network State: Is the air-gapped network confirmed to be isolated? If the context does not match a declared emergency, the glass-break is denied even with valid credentials, preventing social engineering exploits.

In high-assurance air-gapped environments, a logical break-glass must be paired with a physical action to defeat remote exploitation. This often requires an operator to physically press a button on a hardware security module (HSM) or insert a smart card into a reader within the secure perimeter. This air-gap integrity measure ensures that a compromised remote workstation cannot trigger the emergency protocol, binding the digital override to a human physically present at the console.

A security protocol that grants users elevated privileges to critical air-gapped systems only for a limited time window required to complete a specific task. Unlike standing administrative access, JIT access provisions ephemeral credentials that are automatically revoked after expiration, reducing the attack surface for credential theft. In a break-glass scenario, JIT systems can be configured to issue emergency roles with maximum 15-minute lifetimes, forcing operators to re-authenticate and re-justify access if the incident response extends beyond the window.

The practice of defining security and compliance rules in machine-readable definition files, allowing automated enforcement by an admission controller before any resource is provisioned. For break-glass procedures, PaC ensures that emergency access policies—such as dual-person authorization requirements or mandatory audit logging—are version-controlled, tested, and cannot be bypassed by manual configuration drift. Tools like Open Policy Agent (OPA) evaluate real-time requests against Rego policies to determine if emergency access conditions are met.

A dedicated physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. In break-glass workflows, HSMs store the emergency access private keys used to decrypt sealed credentials or sign emergency authorization tokens. The HSM ensures that break-glass keys never leave the tamper-resistant hardware boundary, preventing extraction even if the host system is fully compromised. FIPS 140-2 Level 3 validation is the minimum standard for these modules in defense environments.

A root certificate authority that is kept powered down and physically secured, only brought online in a controlled environment to issue or revoke subordinate certificates. In air-gapped break-glass scenarios, the offline CA issues short-lived emergency authentication certificates that grant temporary administrative access. The physical isolation of the root CA prevents network-based key compromise, while strict ceremonial procedures—including video-recorded multi-person access—govern every certificate issuance event.

A piece of code that intercepts requests to the Kubernetes API server after authentication and authorization, mutating or validating objects to enforce custom security policies before persistence. During a break-glass event, admission controllers can inject mandatory sidecars—such as audit logging proxies or session recorders—into emergency pods, ensuring that all actions taken during the incident are captured regardless of operator configuration. Mutating webhooks enforce non-bypassable compliance guardrails.

A secure storage mechanism where cryptographic keys are generated and stored within a tamper-resistant hardware module, ensuring they are never exposed in plaintext to the host operating system memory. Break-glass procedures rely on hardware-backed keystores to protect emergency decryption keys from memory-scraping malware. Technologies like Android StrongBox and Apple Secure Enclave implement this at the edge, while server-grade TPMs and HSMs provide equivalent protection for data center break-glass workflows.