Do you have a need for additional security when storing your most sensitive data?
Where do you store the company’s banking account numbers and other critical financial data? …top-level credentials for your customer database that contains Credit Card and Social Security numbers? …credentials for classified system access?
When you need that additional layer of security within an already secure system, DoubleLock is your answer. DoubleLock encrypts Secret data with an additional encryption key that is only accessible with an additional password that is unique per user, regardless of permissions or physical access to the machine running Secret Server. Private/public key encryption technology enables you to securely share access to the DoubleLock between users.
Benefits of enabling the DoubleLock feature include:
- Secrets cannot be decrypted even if Secret Server is compromised.
- Secrets cannot be decrypted even when someone is accidentally granted permissions to a Secret based on AD group membership.
- DoubleLock provides an additional grouping of privilege to grant select individuals access to highly sensitive data.
There is one caveat to consider when using DoubleLock:
Resetting a forgotten DoubleLock password is irreversible and can result in permanent loss of the data. In the case that a user has sole access to a DoubleLocked Secret, the data will be lost and the Secret locked with that DoubleLock key will be deleted. However, if another user has access to the Secret, they will need to re-assign you to the DoubleLock.
When resetting a DoubleLock password, a list of the assigned DoubleLocks and the Secrets they protect are displayed for the user. Check that the secrets have at least one additional user with DoubleLock access. This way, the data is not deleted due to a forgotten DoubleLock password.
To enable DoubleLock, a password will need to be created. In Secret Server, click: Tools menu -> Create DoubleLock Password -> enter the desired Password (minimum 8 characters) -> Create Password. Then, click on the Administration menu -> DoubleLock -> Create New button -> type a Name for your DoubleLock -> Save.
Now that a DoubleLock has been created, assign the appropriate users and secrets to the DoubleLock. In more complicated environments, multiple DoubleLocks can be created. Each of these DoubleLocks can be assigned their own set of users. To assign DoubleLock to a secret, click the Edit button on the desired secret. Then, click the Security tab -> check the Enable DoubleLock box -> select the appropriate DoubleLock in the dropdown menu -> Save. Remember that the DoubleLock selected will already have a list of defined users.
As a safety net, always have at least 2 users for each DoubleLock to avoid the potential loss of data if the DoubleLock password has to be reset.
