If we have selected the wrong experience for you, please change it above.
Strengthening ransomware recovery with identity resilience
Prepare for evolving threats with a proactive recovery approach
Ransomware has shifted from a data threat to a recovery threat — and most organizations aren't prepared for that shift. When attackers compromise identity, they don't just disrupt operations; they dismantle the systems teams depend on to respond and recover. Deloitte and Rubrik outline three steps organizations can take to stay ahead of cyber threats.
Key takeaways
- Ransomware now targets identity systems, turning recovery into a business-critical vulnerability
- Cloud-based identity platforms do not guarantee automatic recovery
- Organizations still need to plan for and validate recovery after an attack
- Resilient recovery requires backups, granular rollback and identity workflows
The modern cost of ransomware
The true cost of ransomware is not only data loss. It is operational disruption. Attackers today increasingly focus on compromising identity systems — specifically backup infrastructure, administrative accounts, directories and privileged access systems — which can help them move faster within the organization to disable security and prolong the path to recovery. Identity is now a “stop-the-business” dependency that can materially extend outages and inflate recovery costs.
This risk is often underestimated in cloud-first environments. Many organizations assume that because identity is delivered as software-as-a-service (SaaS), recovery will be automatic and end-to-end. It is not. Even with a SaaS provider, organizations remain accountable for the recoverability of their identity, configurations, and workflows after an attack.
Recovery starts with trusted identity
Identity resilience — the capacity to rapidly restore trusted authentication, privileged access, and directory integrity following an attack — depends on the ability to quickly and safely restore a trusted “last-known-good” state.
This requires using granular rollback to reverse targeted malicious changes and tested identity workflows that address authentication restoration, access re-enablement, and directory integrity validation. When identity resilience is intentionally designed into recovery workflows, organizations can typically restore trusted authentication and privileged access more quickly following an attack.
Together, Deloitte and Rubrik help organizations fortify their systems against identity and data attacks. It begins by understanding which systems are truly mission-critical, a concept we refer to as minimal viable company (MVC) planning: the minimum set of business functions and systems required to sustain operations during recovery.
Three priorities for stronger recovery outcomes
The joint Deloitte and Rubrik point of view, Ransomware as a business-critical threat: Why identity resilience determines recovery outcomes, explores the evolution of today’s ransomware threats and outlines the steps organizations can take to bolster their recovery strategy:
- Prioritize mission-critical services with minimal viable company (MVC) planning
- Continuously test and harden recovery processes, not just backups
- Build resilient identity and access strategies including layered access controls, break-glass access and lockout playbooks
Face evolving cyber threats with confidence
A unified, scalable and secure data management approach can help your organization build a trusted recovery strategy before disruption occurs. Download the full POV for practical guidance to think through strategies that will help your organization recover with greater confidence.
Mike Kosonog
