PowerProtect Data Manager 19.9 Administration and User Guide

Credential security

The PowerProtect Data Manager lockbox securely stores known secrets in a central location.

All stored secrets in the lockbox are encrypted. When an activity requires information from the lockbox, the requesting process provides the lockbox passphrase and then receives the required information in a decrypted format.

The lockbox holds secrets such as:

• Credentials for local user accounts.
• Protection storage credentials that you supply as you configure the appliance.
• Credentials by which application agents authenticate to protected assets.

PowerProtect Data Manager creates a strong, unique passphrase during deployment to protect the lockbox contents. After deployment, PowerProtect Data Manager automatically encrypts and manages the lockbox passphrase without user interaction. Automatic management removes the requirement to provide the lockbox passphrase when you update from supported releases. Server DR backups protect the lockbox and its contents.

The File System agent also uses a separate lockbox on protected hosts to store sensitive information, including the credentials by which the application agent accesses external storage infrastructure.

For Kubernetes, PowerProtect Data Manager stores the necessary certificates and credentials for protection operations in a secret resource on the Kubernetes cluster. The Kubernetes documentation provides more information about how to enable encryption for this secret resource.