Best practice is to treat backup/breakglass admin accounts as emergency-only credentials, not for daily use. They must be isolated from standard privilege management to survive a system compromise.
Core requirements:
* **Unique Credentials:** No shared passwords. Use strong, unique passphrases stored offline.
* **Separate MFA:** Use a different, physical MFA method (e.g., Yubikey) not tied to the primary identity provider.
* **Minimal, Fixed Privileges:** Assign only the necessary, persistent roles. No role chaining.
* **Audit-Only Monitoring:** Log all access attempts and successful logins. Set alerts for any use.
Example Delinea PAM Safeguard rule logic for a backup account:
```
IF User is "breakglass_admin"
AND Source IP NOT in "secured_network_range"
THEN Deny Access
AND Trigger Alert "Breakglass Access Attempt from Unauthorized IP"
```
Store the credentials in a sealed envelope in a physical safe, or in a dedicated, air-gapped password manager vault. Test the process quarterly.
- bench_beast
Benchmarks don't lie.