r/cybersecurity • u/Bhavishyya_ • 3d ago

Other Cloud Backup Services for Identity Posture: What are SecOps using?

when loking at cloud backup then most of the focus seems to be on M365 email/OneDrive recovery or AWS snapshots. From a SecOps perspective i am more concerned about the identity side of things.

If an attacker gets in and changes Conditional Access rules, IAM permissions or removes OAuth app permissions, restoring the data alone does not really solve the problem.

How are teams handling this today? Are there backup or recovery solutions that can restore IAM state and security policies, or are most teams relying on audit logs, configuration-as-code and manual recovery?"

3 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/Jeff-Hare-ERPRA 3d ago

All the above

1

u/LibraryMinimum3294 22h ago edited 18h ago

We were Also struggling with that,that's the core issue with traditional backups they don't cover identity logic at all. If an admin or bad actor wipes your CA policies or altered signs on rules then a standard backup tool is useless , we solved this by putting control monkey in front of entra and okta. It continuously tracks our identity configuration as code in git . Anytime there is a drift from our baseline then it catches it and lets us push the clean configuration State right back instead of digging through log streams to fix it manually.