Protect recovery credentials

Recovery credentials must survive the same disaster as the data. This sounds obvious and gets violated constantly, usually through a circular dependency: the restic password lives in the password manager, the password manager’s vault is backed up in the restic repository, and now each one requires the other. The circle looks fine every day — until the day both ends are gone.

There’s a second, opposite pressure. Credentials also need narrower access than routine backup writing where possible. The server that creates backups every night should hold a credential that can write snapshots but not delete them. Otherwise anyone who compromises the server can destroy the history too — the exact ransomware scenario backups exist for.

Map every credential

Create a credential map without values — locations only, safe to print and circulate:

restic password: password manager emergency record
storage write credential: server secret store
storage delete credential: separate administrator account
recovery instructions: offline runbook copy

Each line answers one recovery question. Where is the repository password when the laptop is dead? Where is the storage credential when the server is gone? Who can delete old data, and is that person’s account separate from the machines doing daily writes?

Then apply the survival test to each row: does this location share a fate with the data it unlocks? A password manager emergency kit printed and stored at a relative’s house survives your house fire. A password.txt on the backed-up laptop doesn’t. The offline runbook copy matters for the same reason — instructions stored only in the wiki are unavailable exactly when the wiki’s server is what died.

Drill it

The map is a claim; a drill is proof. Have an authorized second recovery path locate the required credentials in a drill without revealing them in notes or logs. A partner, a colleague, or you-in-six-months should be able to go from the map to an opened repository using only what the map says. If they get stuck, the map is wrong — fix it now, not during the incident.

The rule that anchors it all: do not store the only decryption key beside the only backup copy or only on the protected machine. Any single place that holds the only copy of a recovery credential is a single point of failure, no matter how secure it is.