NetApp ONTAP Security Hardening - Multi-Admin Verify & Approve

 

ONTAP Multi-Admin Verification (MAV) is a security feature in NetApp ONTAP that requires multiple administrator approvals before performing certain sensitive operations. This feature helps protect against insider threats, human error, or misuse by enforcing a dual-authorization policy for specific administrative actions.

Key Concepts of Multi-Admin Verification (MAV)

• Purpose: Enhance security by requiring multiple admins to approve critical actions such as:

  • Volume deletion

  • Snapshot deletion

  • SVM (Storage Virtual Machine) or LIF deletion

  • Key management operations

  • Security configuration changes

• Minimum ONTAP Version: MAV is supported starting from ONTAP 9.11.1.

How It Works

1. Enable MAV:

   • Use the ONTAP CLI or System Manager to enable the feature.

   • Define a trusted admin group responsible for approving requests.

2. Create MAV-Protected Operations:

   • Identify which commands or actions require verification.

   • Set policies that define the number of approvals needed (typically 2 or more).

3. Request-Approve Flow:

   • Admin A initiates a sensitive action.

   • The action is pending until approved by one or more trusted admins.

   • Trusted Admin B reviews and approves (or denies) the request.

   • Once approved, the action is executed.

4. Audit Trail:

• All MAV activities are logged for traceability and auditing purposes.

Considerations

• Delayed Operations: MAV introduces an intentional delay — actions won’t proceed until approved.

• Trusted Group Management: Be careful who you include in the approver group; they have veto power.

• Not a substitute for RBAC: Use Role-Based Access Control (RBAC) together with MAV for layered security.