About lockdown modes
Lockdown mode protects your cluster data from internal and external threats by securing all the external endpoints from unauthorized access. Access to all the services is protected and authenticated.
Access Appliance lockdown mode offers additional security levels to protect your appliance and data, in addition to the hardened, secure operating environment that comes out of the box.
Lockdown mode provides the following benefits:
It prevents unauthorized access or modification to the underlying operating system (OS). Once the lockdown mode is enabled, administrators cannot make changes to the OS or the internal components. If you need access to the OS for emergency operations, you must contact Veritas Technical Support to obtain a One-Time Password and temporarily unlock the appliance. This functionality prevents unauthorized changes even if a malicious actor gained access to stolen credentials.
It gives the appliance users options for managing WORM (Write Once Read Many) data. Your data is protected from being encrypted, modified, and deleted using WORM properties.
Different lockdown modes provide different level of granularity for WORM and retention. The Access Appliance support three lockdown modes.
Normal mode:
This is the default mode of the cluster if the lockdown mode is not specified during installation. In this mode, WORM and retention capabilities are disabled. User cannot create WORM STUs and WORM-enabled files/objects in this mode.
Enterprise mode:
In this mode, WORM and data retention features are enabled. User can choose to create WORM enabled STUs, files and objects. Also, in this mode user has the option to remove the retention locks and expire image data. The user can extend the retention period but cannot reduce the retention period.
The retention time period can be extended from the WORM enabled STUs and files/objects within them only if the user has the Appliance administrator role.
Compliance mode:
In this mode, WORM and data retention features are enabled. The user can extend the retention period. The user does not have the option to remove retention locks and expire image data from underlying files/objects of WORM STUs and backup images before the predefined time. Once the appliance lockdown mode is set to compliance, the user does not have the option to delete data until it is expired.
Veritas strongly recommends that you enable enterprise lockdown mode to prevent unauthorized access to the OS, even if you do not plan to create WORM storage instances.