Content Matrix 9.9 - Security Guide

Azure Import Pipeline

·When the Import Pipeline is used, security-sensitive information about Azure blob storage SAS URL is stored with Microsoft DPAPI encryption.

·The files uploaded to Azure storage are encrypted with AesCryptoServiceProvider. (If private containers are used, this encryption is optional.)

·If Azure private containers are used with the Import Pipeline, the Azure storage connection string is encrypted with Microsoft DPAPI. (In the case of Distributed Migration, the Azure storage connection string is encrypted with the customer-provided X509 certificate.)

Distributed Migration

Passwords stored in the Distributed Database use customer-provided X509 certificates, which includes encryption. As noted above, if Azure private containers are used, the Azure storage connection string is also encrypted with the certificate.

Jobs Database Credentials

Job database (SQL Server) connection credentials are encrypted with Microsoft DPAPI.

Backward Compatibility

·TDES is supported to decrypt data from version 9.2 or earlier. Beginning in version 9.3, Microsoft DPAPI is used to encrypt data.

·For Public Folder Edition, TDES is used to decrypt passwords for Exchange connections created in version 9.2 or earlier. Beginning in version 9.3, passwords are encrypted with Microsoft DPAPI.