We've been using Delinea (specifically Secret Server) for about three years now, and while the day-to-day password rotation and standard access work well, we found that our process for emergency, break-glass access was a bit of a free-for-all. It relied too much on individuals knowing an undocumented process and created significant audit trail gaps. After a particularly stressful incident last quarter, we sat down and formalized a workflow that has really improved our response time and compliance posture. I wanted to share our template here, as I think it could be adapted to other teams.
Our core requirements were:
* **Speed:** The request and approval must happen outside of standard business hours and without needing the usual primary approvers who might be unavailable.
* **Accountability:** Every action must be logged and tied to a ticket, with a mandatory post-incident review.
* **Least Privilege:** The emergency access should be to a specific set of credentials, not broad vault access, and must have a forced expiration.
Here is the step-by-step workflow we built:
1. **Request Trigger:** All emergencies must start with a P1 ticket in our ITSM system. The requester opens the ticket, which kicks off a dedicated emergency workflow.
2. **Approval Bypass:** We created a dedicated "Emergency Access" role in Delinea. Membership is restricted to a specific security group that contains our on-call managers for the week. The approval on the relevant secret(s) is set to this role, *not* to individuals. This avoids the bottleneck of a single person being unreachable.
3. **Access & Documentation:** The on-call manager retrieves the credential from Delinea. The key step is that they **must** paste the Delinea activity log entry (showing the checkout) into the P1 ticket as a comment. This immutably links the secret access to the incident record.
4. **Forced Expiration & Review:** The secret in question is set to automatically expire 8 hours after checkout. Furthermore, the ticket system automatically generates a subtask that is assigned to the requester's director, requiring a post-mortem review. This review must confirm the necessity of the access and that the logs were properly documented before the ticket can be closed.
The pitfalls we had to avoid:
* Initially, we used a shared account for the emergency role. We switched to individual accounts for the on-call managers to ensure non-repudiation.
* We learned to regularly audit the membership of the security group tied to the Delinea role to ensure it stays current with our on-call schedule.
* Setting the expiration too short (like 1 hour) caused problems for long-running incidents, while setting it too long defeated the purpose. Eight hours was our sweet spot.
This workflow uses Delinea's built-in roles, checkout logs, and expiration features, but ties them all to our external ticketing system for that crucial audit trail. It's been running smoothly for six months now. I'm curious if others have implemented similar emergency protocols, and if you've found any particular Delinea settings (like RDP launch restrictions or command auditing) that are especially useful in these high-stress scenarios.
— frank
buyer beware, but buy smart