Back to Top 10
Illustration for Inadequate Disaster Recovery
NHI10:2025
Inadequate Disaster Recovery
Insufficient planning for recovery and continuity of non-human identities in disaster scenarios.

Details

Without proper disaster recovery planning, organizations risk losing access to critical non-human identities during emergencies. This can lead to extended downtime, data loss, and inability to perform critical operations.

Video Explanation

Enhance Your Security Posture

Enhance Your Security Posture

Learn how to protect your non-human identities and strengthen your overall cybersecurity strategy.

Get Started

Example Scenario

CloudServe, a major cloud services provider, prides itself on its robust infrastructure and redundancy. However, they overlook the importance of including non-human identity management systems in their disaster recovery plans. During a rare natural disaster, their primary data center is severely damaged. While they successfully fail over most systems to their backup site, they discover that their identity and access management (IAM) system, which manages all service account credentials and access policies, was not properly replicated. As a result, even though the backup systems are operational, most services can't authenticate properly, leading to a cascading failure across their entire cloud platform. Thousands of businesses relying on CloudServe experience extended downtime, resulting in millions of dollars in losses, numerous breached SLAs, and a mass exodus of customers to competitors. The incident serves as a wake-up call for the entire industry about the critical importance of including identity systems in disaster recovery planning.

Mitigation Strategies

  • Implement robust backup and recovery procedures for all non-human identity management systems
  • Regularly test disaster recovery plans
  • Use cloud-based or distributed systems for identity management to improve resilience

Best Practices

  • Maintain offline, encrypted backups of critical identity data
  • Implement multi-region redundancy for identity management systems
  • Conduct regular tabletop exercises to test and improve disaster response

References

Related Risks

Improper Offboarding

Inadequate deactivation or removal of non-human identities when no longer needed....

Learn More about Improper OffboardingLearn more about Improper Offboarding
Secret Leakage

Unintended exposure of sensitive non-human identity credentials to unauthorized parties....

Learn More about Secret LeakageLearn more about Secret Leakage
Excessive Permissions

Non-human identities are granted more permissions than necessary for their intended functions....

Learn More about Excessive PermissionsLearn more about Excessive Permissions
Inadequate Rotation

Failure to regularly update or rotate credentials for non-human identities....

Learn More about Inadequate RotationLearn more about Inadequate Rotation