Admin Console - Approval Groups

Open

An Approval Group is a group of users of your PreVeil organization who together authorize the activities of Account Recovery, Data Export, and Admin Management. The purpose of the Approval Group is to:

• Decentralize trust amongst the members of the group

  • Continually verify the trustworthiness of all approval group members

• Prevent single points of failure: If one administrator is lost or unavailable, others in the group may fill in

• Principle of least privilege: Users only have the minimum permissions needed, and only at the time they need them

Creating an Approval Group

• To establish an Approval Group within your organization, you need a minimum of three fully onboarded members

  • The group can comprise of more than three persons

• For a three-person group, two out of the three members of the group will need to approve the activity the group is assigned on

• An approval group must have a required number of approvers

  • The range to pick from is two to N minus one where N is the number of members of the group

To create a group:

• Click the Admin Console icon in the upper right-hand corner of the PreVeil browser application, and then select Approval Group from the menu.
  
  

  Open

  

• Click on the plus sign icon under the Manage tab.
  
  

   

• Give the group a name, and then type in the email address of the first user you want to add. When the user’s email address shows up in the pre-filled drop-down menu, select it to add the user to the group. Repeat to add at least two more additional users to the group. (Remember that you will need to add at least three users before you can create the group; the Create Approval Group button will remain grayed out until at least three users have been added to the group.)
  
  

• Once at least three users have been added to the group, click on the Create button.
  
  

   

• If you create a group with more than three users, then you will have additional options to select from in the How many approvals are required for recovery drop down menu for the required number of approvers

• You will receive a notification that the group has been created
  
  

Activities an Approval Group Can Be Assigned To

The three activities in a PreVeil organization that an Approval Group can be assigned to are:

• Admin Management

  • The purpose of this activity is to restrict administrators in the organization. Assigning a group to this activity will make it so certain activities an administrator performs in the Admin console require group approval

  • The Approval Group assigned to this activity must consist of entirely admin users, as a standard level user will not have access to the Admin console functionality

  • Actions like deleting a user, changing a user’s role, and swapping an approval group will invoke the Admin Management group’s approval

• Data Export

  • Data Export allows an administrator within your organization to download a decrypted copy of the organization’s data

  • An organization must pass the organization health check to complete a full export

  • The types of exportable data are email, drive, activity log, and ACL report

    • Email data is exported in a folder hierarchy consisting of an inbox, drafts, sent, trash, and custom user folders

      • The mail messages are in EML format

    • Drive data is exported in the same folder set as the user’s actual drive and contains the files

    • Activity Log data is exported as a CSV file

    • ACL Report is exported as a CSV file

    • All or a selection of users may be chosen

    • A timeframe is chosen and may span the origin of the organization

  • The Approval Group assigned to this activity may compose of admin users, standard users, or a combination

• Account Recovery

  • The account recovery Approval Group (also known as the Recovery Group) is a group of users within your organization that approve a user’s account recovery

  • PreVeil doesn’t utilize usernames and passwords for account recovery. Instead, what allows a user to access their PreVeil account is an encryption key that gets generated on a user’s device when they create their PreVeil account.

  • Assigning a Recovery Group to a user in your organization will provide each member of the group with a shard of the user’s encryption key. When invoked, the Recovery Group has the ability to rebuild a user’s key on their device, thereby allowing the user to re-access their account.

  • This is the primary method to protect a user’s account access, as PreVeil does not have access to any of our user’s encryption keys, so we cannot restore these keys for you. As such, the responsibility of making sure this recovery method is available to your users will fall upon the administrators of a PreVeil organization creating and assigning a Recovery Group for their users. We strongly recommend that a Recovery Group is assigned to every user in your organization.

  • The Recovery Group can consist of admin level users, standard level users, or a combination of the two.

Assigning an Approval Group

Depending on the activity you are assigning a group to, there are two different methods for doing so.

To assign an Approval Group to either the Admin Management or Data Export activities

• Click on the Assign tab in the Approval Group section of the Admin Console.
  
  

• Click on the Assign button next to either Admin Management or Data Export. For this example we’ll use Data Export.
  
  

   

• Select the group that you want to assign to that activity from the drop down list.
  
  

   

• You will see the details about the group you selected. Click Assign to assign the group to the activity.
  
  

   

• You will receive a confirmation message that the selected group is now assigned to the activity.
  
  

   

To assign an Approval Group as the Recovery Group for your organization’s users

• Select Approval Group from the left hand menu, then click on the Assign tab.
  
  

   

• Click on the Manage Users button.
  
  

   

• Click on the checkbox next to the user (or users) you want to assign the Recovery Group to. (You can assign it to more than one user at a time.)
  
  

   

• Click on the Set Recovery Group button.
  
  

   

• Select the group that you want to assign as the Recovery Group from the drop down list.
  
  

   

• You will see the details about the group you selected. Click Set Recovery Group to assign the group to the users.
  
  

   

• You will receive a confirmation that the group will now be assigned as the Recovery Group for the selected user (or users).
  
  

   

Copying an Approval Group

To make a copy of an existing group:

• Select the checkbox of the group you want to copy, and then click on the copy icon.
  
  

   

• You can then make any changes you want to that group, like changing the name (which is required as you cannot have two Approval Groups with the same name), adding additional users, deleting existing users, and changing the number of required approvers. Once all changes have been made, click on the Create button.
  
  

   

• You will receive confirmation that the new group has been created.
  
  

   

Replacing an Approval Group

An existing Approval Group cannot be modified to add or remove users, but it can be replaced if needed. To replace an Approval Group assigned to an activity:

• Create a new Approval Group using the steps in the Creating An Approval Group section above.

• Assign the new Approval Group to the activity using the steps in the Assigning An Approval Group section above.

• The outgoing Approval Group will need to approve this replacement action before the new group will be assigned to the activity.

Deleting an Approval Group

To delete an Approval Group:

• Select the checkbox of the group you want to delete, and then click on the trash can icon.
  
  

   

• Click Yes to confirm.
  
  

   

• You will receive a notification that the group has been deleted.