Notifications
Clear all
Topic starter
11/07/2026 8:46 pm
TL;DR: Ransomware operators increasingly target backup infrastructure to remove recovery options, and Acsense argues that immutable storage, air-gapped copies, continuous testing, and identity-provider aware recovery are now essential for restoring service and meeting regulatory expectations. The core shift is that backup design has become an IAM resilience issue, not just a storage concern.
NHIMG editorial — based on content published by Acsense: ransomware-proof backup systems for identity and recovery
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: What breaks when ransomware reaches identity backup systems?
A: Recovery fails when the backup layer shares credentials, network reach, or administrative trust with production.
Q: Why do identity providers need immutable backups specifically?
A: Identity providers store the policies, mappings, and sign-in logic that make access possible.
Q: How do security teams know if backup recovery is actually working?
A: They know by testing restorations under realistic conditions and checking whether identity services come back in the right order.
Practitioner guidance
- Separate recovery credentials from production identities Create distinct accounts, keys, and admin boundaries for backup operations so production compromise cannot directly alter recovery copies.
- Make one backup copy immutable and unreachable from production Use write-once retention or logically isolated object storage for the last-known-good copy, and block production systems from having delete or overwrite rights on that copy.
- Test identity restores, not just file restores Run recovery drills for policies, groups, mappings, admin roles, and application integrations, then record whether the restored identity plane actually allows users and services to authenticate.
What's in the full article
Acsense's full guide covers the operational detail this post intentionally leaves for the source:
- Object-level recovery steps for IDP configuration, policies, groups, and mappings
- 30-60-90 day operational playbook with restore drills, runbooks, and audit evidence
- Regulatory mapping for NIS2, DORA, HIPAA, and APRA continuity expectations
- Hot standby tenant design and independent credential requirements for recovery paths
👉 Read Acsense's guide to ransomware-proof backup systems for identity recovery →
Ransomware-proof backups for IDPs: what IAM teams need now?
Explore further
11/07/2026 9:14 pm
Identity recovery has become a governance domain, not a storage domain. When attackers can erase the recovery path, the control problem is no longer backup capacity but identity continuity. Immutable copies, independent credentials, and tested restores determine whether access can be re-established under attack. Practitioners should treat recovery design as part of IAM resilience, not a separate infrastructure conversation.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, which shows how slowly recovery and revocation often move in practice.
A question worth separating out:
Q: Who is accountable when backup recovery for identity systems fails?
A: Accountability should sit with the team that owns identity continuity, not just the storage function. IAM, infrastructure, and GRC all have roles, but the control owner must be able to prove isolation, restore success, and recovery readiness. Regulators increasingly expect documented continuity evidence, not informal assurances.
👉 Read our full editorial: Ransomware-proof backup systems are now an identity control
