OPINION
Enterprises need cyber resilience to ensure that they can sustain operations in the face of ransomware and other cyber threats, and a frequently underappreciated piece of cyber resilience is identity resilience. Identity resilience is a prerequisite to cyber resilience. While you might have a resilience plan for your data and apps, that doesn’t matter if teams can’t access their apps because your identity infrastructure is inaccessible.
Most practitioners are familiar with Active Directory (AD) resilience, given that adversaries frequently target AD to bring down operations. Many practitioners remember the Maersk NotPetya destructive malware incident in 2017 that wiped or rendered unusable nearly all of Maersk’s AD domain controllers and interrupted global shipping and port operations. A single AD domain controller survived because a local office was disconnected from Maersk’s network during the attack due to a power outage, and that lone AD survivor enabled Maersk to rebuild its global identity environment.
Given the potential for catastrophe, identity resilience is top of mind for identity teams and IT operations teams, particularly the business continuity and disaster recovery (BCDR) function. And the world is changing as identity infrastructure has progressed from on-premises AD to cloud-based identity providers (IdPs). The two teams need to collaborate, but they frequently view the problem through different lenses.
The identity team is intimately familiar with the identity and access management (IAM) complexity present in today’s enterprise. Omdia research shows that your average enterprise uses about 1,200 applications, and reconnecting the apps necessary to sustain business operations after an outage can be challenging.
Accessing those applications typically comes via an IdP. While you might think enterprises have a single IdP, there are frequently multiple IdPs when one considers that there may be a customer identity and access management (CIAM) IdP for customer-facing infrastructure along with multiple workforce-focused IdPs caused by a merger or specific organizational requirements. Omdia research found that enterprises more frequently have multiple IdPs rather than a single IdP.
Identity teams realize the need for resilience to recover from a cyber incident; however, identity teams also manage day-to-day operational hiccups that can interrupt operations. These come in the form of issues like configuration drift from upstream systems “feeding” their IdP (HR drift, AI drift) as well as the potential for administrator error (fat-fingering a configuration and consequently having to roll back changes). Such drift has the potential to stop internal operations and external business, while also creating a drift-to-vulnerability pipeline. For identity teams in particular, identity resilience is not simply about IdP uptime.
There is considerable identity nuance involved in this restoration process. For example, after an IdP incident, identity teams must reconnect apps to the IdPs.
IT operations and BCDR professionals typically consider cyber or data resilience as they go about their jobs. They are tasked with keeping an organization’s most critical business services available and restoring them predictably and rapidly after disruption. For cyber threats, this means aligning backup, recovery, and cyber resilience so they can restore a “minimum viable company” to mitigate the financial, operational, regulatory, and reputational consequences of outages caused by threats such as ransomware. They typically focus on backing up to meet recovery time objectives (RTOs) and recovery point objectives (RPOs).
The default IT operations approach is to return operations to a known good point. That is complex for applications and data, but identity infrastructure takes that complexity to a new level. This is not a feature-checkbox exercise of data recovery supporting the IdP but must include dependencies, both upstream and downstream. Identity components need to be orchestrated in the right order with the right level of dependency.
Collaborating for Identity Resilience
Identity and IT operations teams will need to collaborate and up their game to ensure identity resilience in a world of proliferating agent identities. Some key items to consider in establishing and maintaining identity resilience:
-
Understand your identity estate and ensure comprehensive coverage: Understand your entire identity estate (AD, workforce IdPs, CIAM IdPs) and understand the dependencies (what an object relates to across the identity estate) to ensure recoverability of the dependencies
-
Ensure observability: Maintain real-time visibility into change and drift in the identity estate with the ability to remediate something going wrong. This includes establishing known, good states and deciding if drift is acceptable. Observability translates into prevention by controlling against things like fat-fingering and system-based drift (scripts, Terraform).
-
Understand your recovery process: Understand critical operations, groups as well as dependencies, and automated tasks that might need resolving. Validate that the process will help ensure resilience as well as meet compliance obligations, and spot-check that the recovery process aligns with your business priorities around critical app access.
Identity systems underpin access to applications and data, so identity resilience is a prerequisite for cyber resilience. And while identity resilience is essential, it’s not simple. Identity systems are complex, with many dependencies frequently requiring recovery in a specific sequence. Ensuring you have the right technologies and processes in place will keep your identity resilience house in order and avoid a resume-generating event.
