Blog
The break-glass item wants Okta
At 02:18 a leaked deploy key is listing secrets. The plan says use break-glass. The vault item asks for Okta, and the plan also says not to trust Okta. Record the path you could not open.
At 02:18 on 16 October 2026, Priya S (on-call, platform) gets a cloud abuse notice. The key for ci-prod-deploy has been calling ListSecrets and GetSecretValue since 01:40, from an ASN the deploy jobs do not use. The last legitimate use was a CI job on 13 October. Marcus T (incident commander) reads the plan out loud. The containment section says revoke the key, then use the break-glass cloud admin if the actor has already assumed a role. Priya opens the vault item break-glass-cloud-admin. The vault asks for Okta. The identity section of the same plan says do not trust current Okta sessions once cloud IAM and the IdP may be in the same blast radius. Priya stops at the prompt. The hardware key for the offline admin is in a safe in the Austin office. The combination is a second vault item, and that item asks for Okta too. Luis R is the Austin keyholder in a 2024 appendix. Luis is not on this bridge.
A weak record of the next fifteen minutes reads:
Break-glass available. Team would revoke and contain.
A strong one reads:
16 October 2026, 02:18. Cloud abuse notice: ci-prod-deploy listing secrets since 01:40. Plan says revoke the key, then break-glass cloud admin if a role was assumed. T+4 Priya S opened vault item break-glass-cloud-admin. It required Okta. Plan also says do not trust current Okta sessions once IAM and the IdP may share a blast radius. She did not complete the prompt. T+9 Marcus T called Luis R, the Austin keyholder named in the 2024 appendix. Luis is not on the roster and had not answered by T+15. Key not revoked in this sitting. Hardware key not retrieved. Follow-up: Wei L moves break-glass-cloud-admin to a store two named people can open without Okta, and replaces Luis's number, by 30 October 2026.
Both rooms had a plan that said break-glass. Only the second had someone try to open it. The first costs you the hour the key stays live. On the night the abuse notice is about your key, the only admin path still depends on the login you just stopped trusting, and the packet later reads as if that path was practiced.
Two sentences, one path
The miss is that the name and the path disagree. Break-glass cloud admin is a name. The path is whatever a person can open at 02:22 without completing an Okta prompt. If that path is a vault item, a safe, or a sealed envelope in Wei's desk, the packet names it. If the only path wants Okta, the packet says the path was not open, and it names who will change the store.
A line that cannot fail the sitting:
Break-glass credentials are stored securely and available to the security team.
A line the room can miss:
break-glass-cloud-admin opens for Priya S or Wei L without Okta. The Austin safe is the second path. Luis R or the deputy answers a phone call within 15 minutes. Last check that someone other than Luis could open the safe: a date and a name.
The second line is specific enough to be wrong on the night, which is why it is worth practicing. The numbers are yours to set. Nothing here is holding them up as a standard.
Do not finish the Okta prompt to make the note look done
The facilitator will feel the silence at T+4. The easy rescue is to say that, for this exercise, Priya should go ahead and use Okta. She completes the prompt, reads a username, and the note says break-glass opened at T+6. That sitting followed a different plan from the identity section. The identity section said the session was not to be trusted. The room trusted it so the record would show a success.
Leave the prompt unfinished. Call Luis. Write that he did not answer. The gap is the finding. An empty path is the same kind of finding as an empty seat: the plan named a thing, and the people in the room could not reach it. How to write a missing person is in who to invite. This is the missing object. An assessor in March who reads that break-glass opened at T+6 never learns the path still wants Okta.
Hang it on the credential scenario
The cloud credential compromise family already walks a leaked long-lived deploy key, the blast radius across secrets and object storage, and the choice to revoke now or keep a batch job up. One inject in that family is a failed attempt to assume a break-glass admin role. That is the attacker's miss. It is a different question from whether your own admin can open the credential the plan named.
Add that question as its own inject, on a clock, after the abuse notice and before anyone drafts a customer letter:
T+4. You are not allowed to complete an Okta prompt. Open break-glass-cloud-admin, or say you cannot. If you cannot, name the next path and the person who has to answer. Do not revoke ci-prod-deploy from this room.
Revoking the live key is a change to production. The customer-notice clock, if the logs later show a read of a tenant export, is a different sitting, covered in the customer-notice post. Do not let that draft fill the fifteen minutes this path needs.
What the packet records
Write the miss in the free evidence template: who was in the room, the 02:18 notice, the vault prompt Priya did not complete, the call to Luis that was not answered, and Wei's follow-up with a date. If the plan cannot name a path that works when the IdP is the thing you do not trust, run the free plan self-check before you book the hour. The out-of-hours section asks for phone numbers because email is the first thing you lose in an identity incident. A vault item that wants Okta is that failure one step earlier: you cannot even reach the credential those numbers are supposed to unlock. Put the file in the evidence index on the row for the credential exercise, with the date and the owner, so the next questionnaire finds this file.
Reaching a credential without Okta, in this room, shows that these named people could or could not open the path the plan named. It does not revoke ci-prod-deploy, it does not show the Austin safe opens, and it does not show the actor stopped. A rotation in a maintenance window, and a check that someone other than Luis can open the store, answer those. This file is the decision.
Bottom line: name the store that opens without the IdP, and write the minute you could not open it. Break-glass available is a label. The packet has to say which path the room could actually reach.