Quorum Approvals

Quorum approval on FortKnox is an authorization model that ensures that a predefined quorum of approvers must approve sensitive or privileged operations requested by FortKnox prior to those operations being executed.

Quorum approval on FortKnox is an authorization model that ensures that a predefined quorum of approvers must approve sensitive or privileged operations requested by FortKnox prior to those operations being executed.

Quorum approvals help you eliminate the risk associated with a unitary, highly-privileged administrator - specifically to prevent a rogue, poorly trained, or compromised administrator from performing sensitive or privileged operations without authorization or oversight.

In FortKnox, you can define a group of users called a quorum group who can decide to approve whether defined operations initiated by a FortKnox user are allowed to be executed or not.

Only FortKnox users and persistent SSO users are supported for a quorum group.

How Do Quorum Approvals Work in FortKnox?

Once you create a quorum group in FortKnox, any operation controlled by the quorum group requires approval from the group's users (or approvers) for execution. In other words, after a FortKnox user initiates an operation covered by a quorum group, it will not execute immediately. Instead, a request for approval of that operation is sent to the approvers in the quorum group, where the approvers are asked to either approve or reject the request. It is also possible that approvers may fail to act on a request on time.

Quorum-protected operations execute when the approval request receives the minimum number of approvals configured in the quorum group - this could be as few as a single approval or as much as unanimous approval (that is, every approver defined in the quorum group must approve). As soon as the requested operation reaches the approval threshold defined in the quorum group (within a defined time limit), the requested operation is executed immediately.

Similarly, it’s possible that enough approvers will explicitly reject a requested operation such that it is no longer possible to reach the minimum approval threshold. In that case, the operation will be rejected and not executed.

It is also possible that some approvers will fail to act - neither approve nor request a requested operation within the time limit defined in the quorum group. In that case, optional rules defined in the quorum group may allow specific users to unilaterally approve or reject the operation as a fallback or have the operation auto-approved or auto-denied after a certain period.

Considerations

Before you start using quorum approvals, ensure that you understand the following considerations:

The operations under quorum approval will have a delay in execution. This is because the operation executes only when a sufficient number of approvals are received from approvers as defined in the quorum group or the operation falls back to auto-approval after a time limit defined in the quorum group. Hence, the users initiating an operation under quorum must wait for the operation's approval prior to its execution.
Only one operation of each operation type is queued for quorum approval at any given time. For example, suppose a request to add a new user is awaiting quorum approval. In that case, any other requests to add new users are not accepted until the existing add user operation is approved or denied.
Quorum approval is complementary to, but different from RBAC. Quorum approvers who are approving an operation request need not be granted an RBAC role with permission to initiate the operation. RBAC only enforces who can initiate an operation, not who can approve it.
Only the user who initiated the operation under quorum can withdraw the request. An admin cannot withdraw the pending request.

Best Practices

Cohesity recommends the following best practices to use quorum:

Use the predefined templates to identify the sensitive or privileged operations that should be included in a quorum group. Unless instructed by Cohesity Support, do not attempt to select individual operations in a quorum group manually from the List view.
Start implementing quorum groups with a small number of sensitive or privileged operations in a specific operational area of the Cohesity Data Cloud (Self-managed). As your organization's quorum gets familiar with reviewing and approving requested operations, slowly expand quorum approval to other operations.
It is better to maintain multiple quorum groups for different operational areas (for example, access management, network configuration, data protection settings, and so on.) versus a single quorum group covering every possible sensitive or privileged operation. This allows different approvers and approval thresholds to be defined for different types of operations.
Add at least two or more users to the quorum group. Quorum groups with many possible approvers and the lowest possible approval threshold (based on your organization's security policy) will be the most operationally efficient and resilient.
Identify the minimum number of approvers based on your organization's security policy. Adding more approvers than a minimum necessary approvers could further delay the execution of operations.
Avoid configuring quorum groups that require unanimous approval. If a single approver fails to respond on time, the operation may be delayed or not executed.
Actively maintain quorum groups. Periodically review the lists of approvers and adjust as needed, especially to remove users no longer responsible for approving operations on the Cohesity Data Cloud (Self-managed).

Rpaas Documentation