Break-Glass Access for a Payment Vendor
A 450-person fintech runs a payment platform in a single cloud region. The platform vendor's support engineers need break-glass administrative access to production to meet a 30-minute incident SLA. Today the vendor emails the internal platform lead, who creates a shared local admin account and posts the password in the ticket; the account is rarely disabled. An internal audit found 42 shared administrative accounts, passwords unchanged for 200 days, no MFA on administrative access, and no session logging for vendor connections. The vendor contract renews in 60 days. The CTO wants to preserve the SLA and has a limited but real budget for identity tooling. The audit committee asks for a remediation plan that reduces risk without breaking support.
1. Assess the main risks and identify the ISO/IEC 27002:2022 controls that are most relevant.
Read the worked answer
The main risks are loss of accountability and non-repudiation from shared accounts, credential theft or misuse because passwords are old and sent in tickets, unauthorized privileged access without MFA, and inability to detect or investigate vendor activity because sessions are not logged. Relevant controls include 5.15 (access control), 5.16 (identity management), 5.17 (authentication information), 5.18 (access rights), 8.2 (privileged access rights), 8.5 (secure authentication), 8.15 (logging), 8.16 (monitoring), 5.19 to 5.22 (supplier security and monitoring), 5.23 (cloud services), and 8.32 (change management). The SLA is a business requirement, not a justification for shared credentials.
2. Propose a target access model and transitional compensating controls that preserve the 30-minute SLA.
Read the worked answer
Target model: named vendor engineers with federated identities; just-in-time elevation through a privileged access management tool; MFA; approval tied to a ticket; time-bound roles that expire automatically; session recording; and logs to a SIEM with alerts. Transitional controls: immediately rotate all 42 shared passwords, reduce to a small number of vaulted break-glass accounts, enable MFA, and turn on session logging for vendor connections. Keep one sealed break-glass credential with alerting for true emergencies. This preserves a 30-minute SLA because access can be pre-approved for named on-call engineers and granted in minutes, while removing standing shared admin rights.
3. What should be negotiated in the contract renewal, and what if the vendor refuses?
Read the worked answer
Negotiate a security schedule: named personnel, access only through the fintech's identity and PAM controls, MFA, session logging, audit rights, notification of personnel changes, confidentiality, incident notification, and termination of access. Add a right to audit or independent assurance. If the vendor refuses, escalate as a risk decision: accept documented residual risk at CTO level, or select an alternative provider. Do not continue shared accounts simply because the contract renews in 60 days; use the renewal as leverage and set a dated remediation milestone.