Integrate the 2 factor authentication for the recovery console. There is already 2 FA for all backup platforms and you need to get through those if you need to add a device into the recovery console but that doesn't help if you want to protect the information of the devices that have already been added into the recovery console should anyone get access to it.
