Netscape MANAGEMENT SYSTEM 6.0 Installation And Setup Manual page 166

Topology Decisions
Figure 4-3
The Data Recovery Manager is intended for archival and recovery of private
encryption keys only. Therefore end entities must be using either a browser that
supports dual-key generation or a browser that is using Netscape Personal Security
Manager, which supports dual keys. When determining the location of a Data
Recovery Manager, be sure to look into firewall considerations, the physical
security required for each subsystem, and the physical location of the Certificate
Manager agent, Data Recovery Manager agent, and other persons responsible for
administering the Certificate Manager and recovering keys.
Like a Certificate Manager, a Data Recovery Manager has special physical security
requirements, since a compromised Data Recovery Manager would have
devastating security consequences for your entire PKI. You may therefore want to
keep the Data Recovery Manager in a special locked room or building, a choice that
can affect your deployment strategy.
166 Netscape Certificate Management System Installation and Setup Guide • March 2002
Certificate Manager and Data Recovery Manager in different instances