Establish emergency access process

Creating a robust emergency access process is crucial for maintaining availability and security in the event of issues with your centralized identity provider. It ensures that authorized personnel can regain access to critical workloads without compromising security protocols.

Best Practices

Establish an Emergency Access Process

• Define criteria for when emergency access is necessary, such as incidents related to identity provider outages or critical security incidents.
• Create a separate emergency access identity or role with minimal permissions necessary to resolve urgent issues, ensuring it avoids excessive privileges.
• Implement a multi-factor authentication (MFA) requirement for any users accessing the emergency credentials to enhance security.
• Document a clear process for requesting and granting emergency access, including roles responsible for approving the access and the methods used to communicate the access credentials securely.
• Conduct regular testing of the emergency access process to ensure it operates smoothly under pressure and update it based on any learnings.
• Establish logging and monitoring for all activities performed under emergency access to ensure accountability and facilitate audits.
• Review and revoke emergency access immediately after it’s no longer needed, ensuring that any granted permissions are not left open unintentionally.

Questions to ask your team

• Do you have a documented process for granting emergency access to your workloads?
• How frequently is the emergency access process reviewed and updated?
• Are staff trained on the emergency access process and their roles within it?
• What steps are taken to log and monitor emergency access activities?
• How do you ensure the emergency access process is secure and doesn’t introduce additional vulnerabilities?
• Is there a defined time limit for emergency access, and how is it enforced?

Who should be doing this?

Security Administrator

• Develop and oversee the emergency access process.
• Ensure that emergency access procedures are documented and communicated to relevant stakeholders.
• Regularly review and update the emergency access process to adapt to changing security needs.

Identity and Access Management (IAM) Specialist

• Implement technical controls to enable emergency access when necessary.
• Monitor and audit emergency access requests and usage.
• Work with the Security Administrator to ensure compliance with organizational policies.

IT Operations Manager

• Ensure that all personnel involved in the emergency access process are trained and aware of their responsibilities.
• Coordinate response efforts during emergencies to ensure business continuity.
• Maintain communication with stakeholders during an emergency access event.

Compliance Officer

• Review the emergency access process for compliance with regulatory requirements.
• Ensure that documentation related to emergency access is maintained for audit purposes.
• Conduct periodic assessments of the emergency access process to identify areas for improvement.

What evidence shows this is happening in your organization?

• Emergency Access Process Document: A comprehensive policy document outlining the procedures and responsibilities for granting emergency access to AWS workloads, including identification of roles, approval workflows, and contingency measures.
• Emergency Access Checklist: A checklist to ensure all necessary steps are taken when activating the emergency access process, including verification of identity and scope of access required.
• Training Manual for Emergency Access Protocols: A training manual designed for staff, detailing the emergency access protocols, how to execute them, and roles of individuals involved in the process.
• Access Review Dashboard: A dashboard that provides insight into access permissions and logs of emergency access events, ensuring transparency and accountability.
• Incident Response Plan Template: A template for an incident response plan that includes sections specifically for handling scenarios where emergency access is required, ensuring a structured response to issues.

Cloud Services

AWS

• AWS IAM: AWS Identity and Access Management (IAM) allows you to manage access to AWS services and resources securely. You can establish emergency access permissions for users and roles to ensure that access is granted in critical situations.
• AWS Organizations: AWS Organizations helps you centrally manage and govern multiple AWS accounts. You can establish policies that define emergency access scenarios across accounts.
• AWS CloudTrail: AWS CloudTrail enables you to monitor API activity in your AWS account. It provides visibility into who accessed what resources, which is vital for auditing emergency access instances.

Azure

• Azure Active Directory: Azure Active Directory (AD) provides identity and access management capabilities. It includes features for setting up emergency access policies and managing permissions securely.
• Azure Policy: Azure Policy helps you manage permissions by enforcing policies across Azure resources. You can create policies to allow for emergency access to certain resources.

Google Cloud Platform

• Google Cloud IAM: Google Cloud Identity and Access Management (IAM) enables you to control who has access to your cloud resources. You can set up special roles for emergency access situations.
• Google Cloud Audit Logging: Google Cloud Audit Logging enables you to track access to resources and changes made within your Google Cloud environment, which is crucial for managing emergency access.

Question: How do you manage permissions for people and machines?
Pillar: Security (Code: SEC)