When should organisations prioritise identity controls over backup tooling for ransomware defence?

Why This Matters for Security Teams

Ransomware defence fails when teams treat recovery as a substitute for prevention. Backups are essential, but they only help if an attacker cannot reach them, alter them, or steal the data first. Identity controls decide whether an intruder can move laterally, escalate privilege, disable protection, or target backup administrators. That is why access governance, MFA, privileged session control, and service account hygiene often determine whether an incident becomes a recoverable outage or a full-scale business event.

Security programmes that prioritise resilience should map identity protections to the most likely abuse paths, not just to compliance checkboxes. NIST SP 800-53 Rev 5 Security and Privacy Controls remains a useful reference point for enforcing least privilege, auditability, and account management discipline across critical systems. ENISA’s current threat reporting also shows that credential theft and privilege misuse remain central to ransomware operations, which means identity is not a secondary layer but a primary control plane.

In practice, many security teams discover the weakness only after backup jobs are encrypted, recovery accounts are compromised, or immutable storage is deleted through a privileged path that no one had monitored.

How It Works in Practice

Identity controls should take priority whenever ransomware can reach production through human, machine, or third-party identities. The practical question is not whether backups exist, but whether the attacker can obtain the authority to bypass them. Start with the accounts that can disable EDR, access hypervisors, manage cloud consoles, administer backup platforms, and approve privilege elevation. Those pathways are usually more important than the backup product itself because they define what the attacker can touch.

Useful control patterns include:

• Eliminate shared admin accounts and replace them with named identities and traceable approval workflows.
• Require strong MFA for remote access, admin portals, and privileged actions, especially where password-only access still exists.
• Apply PAM for just-in-time elevation and session recording on systems that can alter backups or encrypt recovery points.
• Separate backup administration from domain administration so one compromised identity cannot destroy both operations.
• Inventory long-lived service credentials and rotate or replace them where possible with scoped, short-lived credentials.

For broader control mapping, the NIST control catalogue helps align identity governance to hardening, logging, and recovery safeguards, while the ENISA Threat Landscape is useful for understanding how credential theft, phishing, and initial access regularly precede encryption events. The key is to protect the administrative identities that can alter the recovery process, not just the data stores that hold the backups.

Identity-first defence also improves containment because it can stop the lateral movement phase before the attacker reaches backup infrastructure or exfiltration tooling. These controls tend to break down in flat on-premises networks with reused administrator passwords and no separate backup administration plane because one stolen credential can unlock the entire recovery chain.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, requiring organisations to balance faster recovery workflows against stronger administrative segregation. That tradeoff becomes visible in smaller IT teams, legacy environments, and hybrid estates where shared credentials and emergency access are still embedded in daily operations.

Current guidance suggests a risk-based order rather than a rigid sequence. If the environment already has immutable, isolated backups and strong restoration testing, the next marginal gain may come from identity hardening on backup consoles and privileged endpoints. If backup integrity is weak, then identity and backup improvements must be pursued together because either one can fail independently.

Edge cases matter. In air-gapped or highly segmented environments, backup protection may be less exposed, but identity controls still matter for removable media handling, offline admin access, and recovery approvals. In cloud-first estates, backup tooling is often controlled through the same identity plane as production, so compromise of a single identity provider or federated admin role can undermine both operations. Best practice is evolving for environments that rely on automation and service identities, especially where there is no universal standard for how machine credentials should be vaulted, rotated, and monitored across backup workflows.

The practical test is simple: if an attacker who steals one privileged identity can reach both production and recovery, identity controls deserve priority over backup tooling alone.

Related resources from NHI Mgmt Group

• When should organisations prioritise workload identity controls over more user-focused IAM work?
• When should organisations prioritise browser security over other identity controls?
• When should organisations prioritise identity behaviour analysis over additional point controls?
• When should organisations prioritise code signing certificate renewal controls over new signing tooling?