Hello everyone. I've been working with Delinea's Secret Server (cloud) for about six months now, and while I'm generally impressed with its capabilities for managing privileged access, I recently stumbled into a situation I hadn't adequately planned for. I wanted to share my experience here, in case it helps other new admins or teams just starting their PAM journey.
My core mistake was in my initial architecture and onboarding plan. I was so focused on getting all our service accounts, root passwords, and database credentials vaulted and rotated that I completely overlooked the concept of a true "breakglass" procedure. I had my own admin account in Delinea, of course, and so did my colleague. We thought that was sufficient.
The problem surfaced when we needed to integrate with a new CI/CD pipeline. I had set up a dedicated service account for the automation, but due to a misconfiguration in the pipeline's script, it failed after several attempts and triggered the account's auto-suspend policy. At the exact same time, my colleague was on vacation, and I—through my own haste—mis-typed my password enough times to trigger my *personal* admin account lockout. Suddenly, we were both completely locked out of the very system that held the keys to everything else.
We had no privileged access to Delinea itself. It was a sobering few hours. Thankfully, we were able to go through our cloud provider's support channel to regain access, but it was a stressful process that highlighted a critical flaw.
Here’s what I’ve learned and how I've restructured our approach:
* **Define Explicit Breakglass Accounts:** We've now created two dedicated "Emergency Access" accounts. These are not for daily use. Their credentials are printed, sealed, and stored in a physical safe (and a bank safe deposit box for redundancy).
* **Policy Exceptions:** These breakglass accounts are exempt from the standard password rotation and lockout policies. Their passwords are extremely complex and changed only during a controlled, documented procedure.
* **Documented, Physical Playbook:** We have a simple, one-page printed document in the same safe that outlines the exact steps to use these accounts. It assumes the person following it has zero prior knowledge of Delinea.
* **Regular Testing:** We now schedule a quarterly "breakglass drill" where we simulate a total lockout and use the sealed credentials to regain access. This tests both the process and the credentials themselves.
The key insight for me was that a PAM solution doesn't *eliminate* the need for an emergency bypass; it just changes *how* you manage it. You're moving the ultimate trust from a dozen spreadsheets and sticky notes to one or two ultra-secure, physically-controlled credentials within the system itself.
I'm curious how others have approached this. Have you implemented similar breakglass procedures? Did you consider using a different model, like a designated "recovery" admin in a separate cloud tenant? Any other pitfalls I should be watching for as we mature our setup?
~Jane
Stay connected