SaaS breaches have increased 4x in the last year. We have seen a sequence of breaches that have impacted major SaaS vendors, such as Microsoft and Okta. Snowflake has been in the news recently due to attacks targeted at customer-owned systems. The common thread of these breaches is identity. The attackers are not breaking in, they are logging in.

SaaS is now a very active space, where attacks are occurring across the spectrum, from targeted APTs to financially motivated attackers, and every company needs to carefully review their SaaS security program. As with any SaaS application, customers have a shared responsibility with the provider to make sure the data is safe. 

Snowflake is a critical component of many businesses with the platform at the core of data collaboration, AI, personalization and customer engagement initiatives. Securing this critical business infrastructure against threats is critical, but can also be complex without the requisite expertise. 

If you are looking to immediately address any unauthorized access to your Snowflake environment, review our accompanying blog that discusses immediate steps you can take to minimize impact.

Here are steps customers can take to ensure their Snowflake instances are safe. 

1. Harden identities with access to your Snowflake environment

Configuration drifts and over-privileged users are often cause of breach or lead to a larger breach impact. In fact 1-in-5 SaaS breaches we see stems from basic posture issues. The recent Microsoft breach leveraged a test account to drive the compromise. 

Ensuring the right posture for your Snowflake includes several steps. However, here are 3 critical steps:

1. Eliminate users bypassing the IdP. There are few reasons for local access. Review and eliminate local access accounts, except any necessary ones. Attackers use local access as backup pathways. Hence, it’s crucial to monitor these.

2. Make multi-factor authentication (MFA) mandatory. Why wouldn’t you in this day and age? Ensure all users, especially privileged accounts, have MFA enabled. For any service accounts, use client ID and secret – not password – for the handful of legitimate local accounts (e.g. breakglass accounts) implement Snowflake’s native MFA.

3. It might also help to restrict where users can access your environments from. For example, any local account access could be restricted to users from specific IP address or IP ranges. Define network policies to restrict access to specific IP or range of IPs

2. Eliminate unused identities

Inactive identities are ripe ground for attackers. Identify and eliminate inactive accounts – prioritize privileged accounts first.

3. Govern data movement within the Snowflake environments

Data is at the heart of Snowflake. Managing data movement is important to allow value creation, but governing is equally important to disallow data exfiltration (MITRE ATT&CK TA0010). An employee may unknowingly (or knowingly, if an attack is using stolen credentials) export data to a location that is unapproved by the organization’s security teams. 

Organizations can and should restrict data export from their accounts to external cloud storage, internal locations, and also govern the locations for data export through Snowflake account level parameters such as:

• PREVENT_UNLOAD_TO_INLINE_URL
• REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION
• REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION
• PREVENT_UNLOAD_TO_INTERNAL_STAGES 

Additionally, organizations must also identify and manage connected applications that may be using less secure authentication methods to access data from Snowflake environments.

[Add graphic from product]

4. Monitor and protect users with access to Snowflake

Hardening and prevention are the first step in ensuring security of your Snowflake environments. They minimize the risk of breaches. However, it’s equally important for organizations to monitor users that have access. These include preventing spearphishing threats targeting Snowflake administrators and users and monitoring these user accounts for abnormal activities. 

Or if you have indicators from your threat intelligence provider, you could also hunt for suspicious activities within your account.

5. Align with Snowflake CIS benchmarks

A simple step that you can take in addition to the above is to align with the Snowflake CIS Benchmarks to prevent unauthorized access, enforce least privilege access, and mitigate data exfiltration risk. 

SaaS applications aren’t static. They change – applications evolve, configurations change, identities get introduced, and attackers change their patterns. Your program needs to be continuous to keep up with your SaaS. In other words, you need automation to scale this across all your SaaS applications.

Obsidian has helped several organizations automate their workflows and ensure security of their Snowflake environments. To learn more about how Obsidian can help you or to get an assessment of your Snowflake deployment contact us today. 

The post Securing Your Snowflake Environments appeared first on Obsidian Security.

*** This is a Security Bloggers Network syndicated blog from Obsidian Security authored by Farah Iyer. Read the original post at: https://www.obsidiansecurity.com/blog/securing-your-snowflake-environments/