Segregation of Duties

Segregation of Duties is a principle defined by NIST as ensuring that no user has enough privileges to misuse a system on their own. It is complementary to least privilege: least privilege limits how much a single account can do, while segregation of duties addresses a different request - whether certain actions should ever be completable by one user alone, regardless of how much that user’s role permits.

Why this matters beyond least privilege

A well-scoped role limits what a user can do within their area of responsibility. It does not, by itself, prevent that user from acting alone within that scope. A single account, even one with carefully restricted permissions, can still make an accidental or malicious change unilaterally. Segregation of duties closes this gap by requiring more than one identity to be involved before a sensitive action takes effect.

Zero Trust in practice: Veeam has Four-Eyes Authorization

Four-Eyes Authorization is Veeam’s implementation of segregation of duties in VBR and VSA. When enabled, certain sensitive operations require a second user to approve the action before it is carried out, rather than allowing a single administrator to complete it alone. For configuration details, see the official documentation.

VSA Security Officer

On the Veeam Software Appliance, this control is enforced by the Security Officer role at the application layer. A system-level administrator cannot bypass it - approval from the Security Officer role is required regardless of what privileges the administrator holds.

Secure by default to balance security and operations

Four-Eyes is designed by Veeam to be balanced against day-to-day operations, consistent with Secure by Design: it applies only to actions that are potentially damaging, not to every operation, and this set of protected actions is defined in advance by Veeam rather than being user-configurable - or said differently, malicious administrators cannot remove certain operations from the list of those protected by Four-Eyes.

The one place this balance can be broken is during VSA installation, where an administrator can choose to disable the Security Officer role entirely. This choice cannot be reversed without reinstalling the appliance from scratch, and is strongly discouraged in production environments, as already noted in IAM Best Practices.

Zero Trust in practice: DO NOT avoid Security Officer, Use it!