Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Infrastructure Entitlement Management (CIEM)Medium
A cloud security team is tasked with implementing a 'break glass' procedure for emergency administrative access in their AWS environment. This procedure requires that the 'break glass' role is only activated under strict conditions, such as a confirmed incident, and its activity is meticulously logged and audited. How can Prisma Cloud CIEM support the auditing and monitoring of such a 'break glass' role effectively?
- AThrough real-time anomaly detection and detailed activity logging for the role.
- BLeveraging DSPM to classify data accessed by the role.
- CBy setting up a continuous CSPM policy to check the role's creation date.
- DBy enforcing network microsegmentation around the 'break glass' role.
Show answer & explanationAnswer & explanation
Correct answer: A. Through real-time anomaly detection and detailed activity logging for the role.
Prisma Cloud CIEM's real-time anomaly detection can monitor for unusual activation or usage patterns of the 'break glass' role, while its detailed activity logging ensures all actions performed by that role are recorded and available for audit. This combination provides the necessary oversight for such a critical and sensitive role.
Why the other options are wrong
- B. DSPM is for data classification, not for monitoring the activity of an emergency administrative role.
- C. Checking creation date is insufficient for monitoring activation and activity.
- D. Network microsegmentation controls network access, not the auditing of role activation and activity.
'Break Glass' Role Auditing
The process of rigorously monitoring and logging the activation and activity of emergency administrative roles to ensure their use is justified and compliant.
- Critical for incident response
- Requires real-time monitoring
- Demands comprehensive audit trails
Memory trick: Emergency access needs sharp eyes and a clear history.