SNOWFLAKE SECURITY · ODBC JDBC Web UI Custom Load Balancer HTTPS All communication encrypted...

© 2019 Snowflake Inc. All Rights Reserved

SNOWFLAKESECURITY


Setting the Stage


Snowflake is a SaaS Data Warehouse

● Customers Create and Manage Users● Customers Load Data● Customers Execute Commands● Customers Export Data

● Snowflake Service Processes Requests● Snowflake Service Maintains Security● Snowflake Service Manages Capacity

● Snowflake Personnel Do Not Have Access to Unencrypted Customer Data

● Snowflake Personnel Do Not Collect, Delete, Update, Disclose, or Use Customer Data

WHAT IS SNOWFLAKE?IaaS Region

S3/BlobStorage

Customer Environment (VNET/VPC/On-Prem)

CloudServices

VirtualWarehouses

Metadata Store

LoadBalancer

Snowflake Multi-Tenant Pod

Cloud Gateway

Snowflake Deployment


Snowflake Editions


SNOWFLAKE SECURITY AT A GLANCE

5

Snowflake Operational Controls• NIST 800-53• SOC2 Type 2• ISO 27001

Access• All communication

secured & encrypted• TLS 1.2 encryption for all

client communications• IP Whitelisting

Authentication• User Provisioning with SCIM• Password Policy

enforcement

• Multifactor Authentication• SSO using SAML 2.0

Federated Authentication

• Key Pair (link to snowsql, but supported all over)

Authorization• RBAC for data

and actions• OAuth2.0 authorization

framework support• Secure views and UDFs to

protect information access

• Full audit trails for every action any user does

Data• Encrypted at rest• Hierarchical key model

rooted in AWS Cloud HSMor Azure Dedicated HSM

• Automatic key rotation• Time Travel 1 day

• Fail Safe

Infrastructure• AWS, Azure Physical Security• AWS, Azure Redundancy• Regional Data Centers

▪ US▪ EU▪ AP

Standard/Premier

Premier – the following security and compliance features may be added on for an additional fee:• Time Travel up to 90 days• Annual re-keying of encrypted data

https://docs.snowflake.net/manuals/user-guide/security-encryption.html

https://docs.snowflake.net/manuals/user-guide/network-policies.html

https://docs.snowflake.net/manuals/user-guide/scim.html

https://docs.snowflake.net/manuals/user-guide/admin-user-management.html

https://docs.snowflake.net/manuals/user-guide/security-mfa.html

https://docs.snowflake.net/manuals/user-guide/admin-security-fed-auth.html

https://docs.snowflake.net/manuals/user-guide/snowsql-start.html

https://docs.snowflake.net/manuals/user-guide/security-access-control.html

https://docs.snowflake.net/manuals/user-guide/oauth-intro.html

https://docs.snowflake.net/manuals/user-guide/views-secure.html

https://www.snowflake.com/blog/the-power-of-secure-user-defined-functions-for-protecting-shared-data/

https://docs.snowflake.net/manuals/sql-reference/account-usage.html

https://www.snowflake.com/blog/encryption-key-management-in-snowflake/

https://docs.aws.amazon.com/cloudhsm/

https://docs.microsoft.com/en-us/azure/dedicated-hsm/


https://docs.snowflake.net/manuals/user-guide/data-time-travel.html

https://docs.snowflake.net/manuals/user-guide/data-failsafe.html


SNOWFLAKE SECURITY AT A GLANCEEnterprise

6

Snowflake Operational Controls• NIST 800-53• SOC2 Type 2• ISO 27001



client communications• IP Whitelisting


enforcement




Authorization• RBAC for data


framework support• Secure views and UDFs to

protect information access




• Automatic key rotation• Yearly re-keying

• Time Travel 1-90 days• Fail Safe


▪ US▪ EU▪ AP






















7

Snowflake Operational Controls• FedRAMP / NIST 800-53• HIPAA• PCI

• ISO/IEC 27001 • SOC2 Type 2• SOC1 Type 2

Business Critical Edition



client communications• Option for encryption in both

trusted and untrusted networks

• IP Whitelisting

• Support for Azure Cross VNET rules for Blob access

• Integration with AWS PrivateLink


enforcement




Authorization• Flexible & granular

authorization controls• RBAC for data


framework support

• Secure views and UDFs to protect information access




• Automatic key rotation• Yearly re-keying

• Tri-Secret Secure (BYOK)• Time Travel 1-90 days

• Fail Safe


▪ US▪ EU▪ AP



https://docs.snowflake.net/manuals/user-guide/data-load-azure-config.html

https://docs.snowflake.net/manuals/user-guide/admin-security-privatelink.html




















Details



9

IaaS Region

S3/BlobStorage

Snowflake VNET / VPC

Customer Environment (VNET/VPC/On-Prem)

CloudServices

VirtualWarehouses

Metadata Store

LoadBalancer

Snowflake Multi-Tenant Pod

Customer Dedicated Virtual Instances

Secure traffic between all points(Encrypted at rest and in transit)

Tri-Secret Secure Customer Managed Keys (Bring Your Own Key enabled)

Cloud Gateway

Snowflake Deployment


Access & Authorization


ACCESS – SECURE COMMUNICATION

11

11

SnowflakeVNET/VPC

ODBC JDBC Web UI Custom

Load Balancer

HTTPS

All communication encrypted end-to-end● Web UI, command line client, and drivers communicate

solely over HTTPS● Connections encrypted using TLS 1.2 from client through

to Snowflake Service● Data encrypted at rest

All access controlled● IP whitelisting available to restrict client communication to

specified IP addresses● Authentication required for all connections

Customer-Configured Network Policy



SnowflakeAD (or Others)

Authoritative Directory in Control

● User creation, changes & deletes

● Roles driven by group membership

● Use Okta, Azure AD, or any system that speaks SCIM

● Or any that can use SQL

USER PROVISIONING WITH SCIM

12

Role 1New Role

Role 2

Group 1New Group

Group 2

New New

Change Change

New Member Now Assigned

SCIM

SCIM

SCIM

SCIM



Authorization Control● Role-based authorization

● Authorization for access to all database objects—databases, schemas, tables…

● Authorization for operations in Snowflake—create, stop & start virtual warehouses

● DAC and RBAC info

Application Auditing● All actions are logged

● Audit Logs available throughSnowflake Service

APPLICATION SECURITY

13

Role 1View tables X, YUse warehouse A

Role 2View table YModify table YUse warehouse B

Users



Encryption


HIERARCHICAL ENCRYPTION FOR DATA AT REST

15

Hierarchical Key Model using Tri-Secret Secure Key Rotation & Re-Keying

• Keys rotated by Snowflake• All data re-encrypted with

annual re-keying• Transparent to customer

and queries

More resources on Key Management

• Hierarchical key model rooted in AWS Cloud HSMor Azure Dedicated HSM

• Tri-Secret Secure• Data is encrypted by default,

with no configuration required

https://www.snowflake.com/blog/encryption-key-management-in-snowflake





TIME TRAVEL & FAIL SAFE

Time Travel

● Select from data as it existed in the past, e.g. before some specific event

● Up to 90 days

Fail Safe

● Request recovery of lost data

● Up to 7 days for most objects

More on Time Travel & Fail Safe

https://docs.snowflake.net/manuals/user-guide/data-availability.html


Application Logging & Monitoring


History Tab● Provides a list of all commands

● Clicking on any item brings up additional details about the action

● For errors, provides SQL as well as a verbose error statement

APPLICATION ACTIVITY LOGGING

18


The LOGIN_HISTORY family of table functions can be used to query login attempts by Snowflake users along various dimensions. More information can be found in our LOGIN_HISTORY documentation.

EXPORTING USER ACCESS AUDIT LOGS – LOGIN_HISTORY

19

● LOGIN_HISTORY – returns login events within a specified time range

● LOGIN_HISTORY_BY_USER– returns login events of a specified user within a specified time range

● Results can be further filtered using SQL predicates

● Can be used to return login activity for up to 7 days inthe past

● Export as JSON for use in SIEM or Snowflake

Column Name Data Type Description

EVENT_TIMESTAMP TIMESTAMP_LTZ Time of the event occurrence.

EVENT_ID NUMBER Event’s unique id.

EVENT_TYPE TEXT Event type, such as LOGIN for authentication events.

USER_NAME TEXT User associated with this event.

CLIENT_IP TEXT IP address where the request originated from.

REPORTED_CLIENT_TYPE TEXT Reported type of the client software, such as JDBC_DRIVER, ODBC_DRIVER, etc. This information is not authenticated.

REPORTED_CLIENT_VERSION TEXT Reported version of the client software.This information is not authenticated.

FIRST_AUTHENTICATION_FACTOR TEXT Method used to authenticate the user(the first factor, if using multi factor authentication).

SECOND_AUTHENTICATION_FACTOR TEXT The second factor, if using multi factor authentication, or NULL otherwise.

IS_SUCCESS TEXT Whether the user’s request was successful or not.

ERROR_CODE NUMBER Error code, if the request was not successful.

ERROR_MESSAGE TEXT Error message returned to the user, if the request was not successful.

RELATED_EVENT_ID NUMBER Reserved for future use.

https://docs.snowflake.net/manuals/sql-reference/functions/login_history.html


● QUERY_HISTORY returns queries within a specified time range.

● QUERY_HISTORY_BY_SESSIONreturns queries within a specified session and time range.

● QUERY_HISTORY_BY_USERreturns queries submitted by a specified user within a specified time range.

● QUERY_HISTORY_BY_WAREHOUSE returns queries executed by a specified warehouse within a specified time range.

● Up to 7 days

EXPORTING QUERY LOGS – QUERY_HISTORY

20


EXPORTING USER ACCESS AUDIT LOGS

21

● History logs via functions and views

● LOGIN_HISTORY● QUERY_HISTORY

● Results can be further filtered using SQL predicates

● Can be used to return login activity for up to 7 days in functions 365 days in views in the past

● Export through JDBC or as JSON for use in SIEM

● All supplied drivers and connectors also have extended logging

https://docs.snowflake.net/manuals/sql-reference/functions/login_history.html

https://docs.snowflake.net/manuals/sql-reference/functions/query_history.html

https://community.snowflake.com/s/article/How-to-generate-log-file-on-Snowflake-connectors


Infrastructure Security


INFRASTRUCTURE SECURITY & MONITORING

Infrastructure is managed and monitored by SnowflakeCritical Security Controls Dashboard• Access Control, Security Assessment & Authorization, Configuration Management, Security Awareness,

etc. all represented on a single Dashboard

• Real-time monitoring of data loaded into Snowflake from internal and other relevant data sources

• Allows Security Compliance Team and relevant stakeholders across Snowflake to have real-time visibility into Risk

Snowflake uses CIS Benchmark Templates for configuration hardening• Configuration information is collected centrally in Snowflake

• Snowflake Security Compliance Team monitors status, tracks findings

• Part of Snowflake’s Compliance Dashboard


VULNERABILITY TESTING & REMEDIATION

Snowflake performs 7-12 3rd Party penetration Tests per year• Comprehensive Web Application Penetration Test – Annually

• Internal Network Penetration Test – Annually

• Major Functionality Penetration Tests – As major functionality is released

Snowflake performs weekly vulnerability scans on infrastructure• Vulnerabilities are remediated per Policy

• Remediation trends tracked using Snowflake


Snowflake uses advanced threat detection tools to monitor production infrastructure● Failed logins

● File integrity monitoring

● Unauthorized system modifications

Snowflake also uses behavioral monitoring tools to monitor a baseline of production infrastructure behavior

● Network traffic

● User activity

● Binaries

Logs are Centralized in Snowflake

● Cost savings, Flexibility, Familiarity with existing tools (Tableau, Looker, Sigma)

THREAT DETECTION

25


SECURITY ANALYTICS WAREHOUSESnowflake Internal

26

Threat intelligence

Vendors

SecurityEngineers

Internet Registration Trackers

Security Solution

Providers

“Known Good” Trackers

Indicators of CompromiseTTPs and Attribution

Hash WhitelistsDetection Queries

Suppression QueriesSecurity AlertsRaw Events


SECURITY ANALYTICS WAREHOUSESnowflake Internal

27

Query examples:AWS login without MFA?Customer bucket / blob data modified?Unauthorized install on server?Grant permissions on Snowflake?

Log Data Table

QueryTable

AlertsTable

SERVERLESS


INFRASTRUCTURE LOGGING & MONITORING

SnowAlert provides a security analytics framework

OpenSource, hosted on GitHub

Integrates with other systems for notification and tracking (Slack, JIRA, etc.)

Provides real-time data and trends

Snowflake’s Security Analytics Warehouse

SnowAlert and sample alert to detect the startup of shell scripts in the EC2 environment

https://github.com/snowflakedb/SnowAlert

https://resources.snowflake.com/security-analytics/snowflake-for-security-analytics%3Futm_cta=website-security-compliance-anti-fraud-module-Snowflake-for-Security-Compliance-Fraud&_ga=2.104017408.1229720565.1573512505-1010080444.1561063469


SNOWALERT – SAMPLE ALERTS

Display a dashboard of actionable alerts with links to issue-tracking systems

Show trends to measure improvement, monitor problem areas


Compliance Frameworks


COMPLIANCEThird Party Attestations and Certifications

31

Self-AssessmentsCAIQ, SIG, Pen Test Results

SOC 1 Type II6 month Coverage Period

SOC 2 Type II12 Month Coverage Period

PCI-DSS HIPAAHITRUST in Progress

FedRAMP(Available from OMB/MAX)

ISO/IEC 27001


What it is● GDPR is a new EU regulation that becomes effective on May 25, 2018

● Governs the protection and processing of EU personal data

What it means in the context of SnowflakeDifferent requirements apply to different types of entities

● Controller – Snowflake Customers are responsible for complying with GDPR independently from Snowflake

● Processor – Snowflake is responsible for the following:

○ Putting data processing addendums in place with our customers and our vendors

○ Only using our customers' EU personal data to provide our service to them

○ Being transparent about how we handle and process our customers' EU personal data on their behalf and keeping accurate records

○ Securing customers’ EU personal data in our service

○ Facilitating our customers' compliance with data subject requests

○ Notifying customers about changes to our list of subcontractors

Snowflake responsibilities are documented in a Data Processing Addendum (DPA on snowflake.com/legal)Available for signature now

GDPR – GENERAL DATA PROTECTION REGULATION

32

https://www.snowflake.com/legal/


Snowflake Security Product DocumentationThe above link provides information on how to configure:

● Network Policies● MFA, IP Whitelisting● Federated Authentication / SSO● Access Control (DAC, RBAC)● Best Practices● Audit Logs

ADDITIONAL COLLATERAL

33

https://docs.snowflake.net/manuals/user-guide/admin-security.html


THANK YOU

SNOWFLAKE SECURITY · ODBC JDBC Web UI Custom Load Balancer HTTPS All communication encrypted...

Documents

Transcript of SNOWFLAKE SECURITY · ODBC JDBC Web UI Custom Load Balancer HTTPS All communication encrypted...