CommCell Security

To be clear, you do not need email for MFA.  You can use common PIN generating apps.  Google and Microsoft are mentioned, but any app following RFC 6238 will work.  e.g. Cisco Duo, etc.

https://documentation.commvault.com/11.40/software/pin_generating_tools.html

If you stay with the password, I have seen customers use a password check-out system where 2 people each check out their half of the password.  Any actions are taken with both present and then they log off the account.  No single person has access to the full admin password.

Thanks,
Scott
 

​@Scott Moseman thanks for your reply. If I was to restore my CS in a dark site after a Cyber attack I don't think the build in MFA codes will work, this is why I have a break glass account. 

My fear is can this account can be compromised via SQL queries etc

The local accounts are stored in the database so, technically, yes they could be compromised by someone with the right SQL access.  Although if someone has SQL access they would have the ability to compromise a more than just the local accounts.

There are some suggestions for hardening the SQL Server:

https://documentation.commvault.com/11.40/commcell-console/securing_commserve_computer.html

Thanks,
Scott