Snowflake Security: Securing Your Snowflake Data Cloud

Description

This book is your complete guide to Snowflake security, covering account security, authentication, data access control, logging and monitoring, and more. It will help you make sure that you are using the security controls in a right way, are on top of access control, and making the most of the security features in Snowflake. Snowflake is the fastest growing cloud data warehouse in the world, and having the right methodology to protect the data is important both to data engineers and security teams. It allows for faster data enablement for organizations, as well as reducing security risks, meeting compliance requirements, and solving data privacy challenges. There are currently tens of thousands of people who are either data engineers/data ops in Snowflake-using organizations, or security people in such organizations. This book provides guidance when you want to apply certain capabilities, such as data masking, row-level security, column-level security, tackling role hierarchy, building monitoring dashboards, etc., to your organizations. What You Will Learn Implement security best practices for Snowflake Set up user provisioning, MFA, OAuth, and SSOSet up a Snowflake security modelDesign roles architectureUse advanced access control such as row-based security and dynamic maskingAudit and monitor your Snowflake Data Cloud Who This Book Is For Data engineers, data privacy professionals, and security teams either with security knowledge (preferably some data security knowledge) or with data engineering knowledge; in other words,  either “Snowflake people” or “data people” who want to get security right, or “security people” who want to make sure that Snowflake gets handled right in terms of security Table of Contents About the Authors About the Technical Reviewers Acknowledgments Foreword Introduction Let’s Get Started Chapter 1: Snowflake Organization Structure 1.1. Single Account vs. Multiple Accounts 1.1.1. Scaling Multiple Accounts Management 1.2. Choosing the Right Pricing Plan 1.3. Summary Chapter 2: Infrastructure Security 2.1. Account Data Storage 2.2. Access to the Stored Data 2.2.1. The Standard Multi-tenant Deployment 2.2.2. Business Critical Edition 2.2.3. Virtual Private Snowflake 2.2.4. PrivateLink 2.3. Access to Historical Data 2.3.1. Stage Data 2.3.2. Internal or External Backup 2.3.3. Time Travel 2.3.4. Fail-Safe 2.4. Good to Know 2.5. Summary Chapter 3: Data Encryption and Ingestion 3.1. Encryption of Data in Transit 3.2. Encryption at Rest 3.2.1. Uploading Files to Staging Areas 3.2.2. Snowflake-Provided Staging Areas 3.2.3. Customer-Provided Staging Areas 3.2.4. Using Storage Integration 3.2.5. How Snowflake Encrypts Your Data in Tables Snowflake Hierarchical Key Model 3.2.6. Unloading Files to Staging Areas 3.2.7. External Tables 3.2.8. Customer Managed Keys 3.2.9. Application-Level Encryption 3.3. Summary Chapter 4: Authentication: Keeping Strangers Out 4.1. Users Management 4.2. User Provisioning 4.2.1. SCIM Integration Okta Integration User Management Role Management Security Considerations ACME Candies Wants This! Azure Active Directory Integration Setting Up the Integration in Snowflake Setting Up the Integration in Azure Other SCIM Assigning a Network Policy over SCIM SCIM Token Management Debugging and Monitoring SCIM 4.2.2. User Provisioning Using SQL Integration 4.2.3. Combining SCIM and SQL Integration 4.3. Authentication Types 4.3.1. Built-In Authentication Password Policy Enforcement Client Sessions Keep Alive Multifactor Authentication (MFA) in Snowflake Setting Up MFA in Snowflake So... Should You Use It? 4.3.2. Federation: Single Sign-On (SSO) Integration Setting Up SAML 2.0 Federated Authentication Setting Up SSO Integration with Okta Setting Up SSO Integration with Other SAML 2.0 Providers SSO for Code SSO Connection Caching SSO with Automated Okta Authentication SSO for BI Tools 4.3.3. Nonhuman Authentication Key-Pair Authentication Using Key-Pair Authentication in Production Rotating Your Key Pairs Snowflake SQL API SQL API Security Notes Preventing SQL Injection in Application Queries 4.3.4. Compensating Factors in Authentication 4.4. Summary Chapter 5: Network Access Control 5.1. How Do Network Access Policies Work? 5.1.1. Setting Up Account-Level Network Policy 5.1.2. Setting Up User-Level Network Policy 5.1.3. Limitations No Group-Level Granularity Workarounds No Granularity Within Account Workarounds Network Policies Are Only IPv4 5.2. PrivateLink Integrations 5.3. Summary Chapter 6: Authorization: Data Access Control 6.1. Data Access Models 6.1.1. MAC (Mandatory Access Control) 6.1.2. DAC (Discretionary Access Control) 6.1.3. ABAC (Attribute-Based Access Control) 6.1.4. RBAC (Role-Based Access Control) 6.2. Snowflake Access Control Model 6.2.1. Snowflake Security Model 6.2.2. The Built-In Roles in Snowflake 6.3. Designing Your Role Architecture 6.3.1. Document Your Role Architecture 6.3.2. Privilege Granting 6.3.3. Approaches to Access Management IdP-Dominated Access Classic Snowflake Role Management Per Project Roles Role Per User Functional Roles Coupled with Access Roles Role Hierarchy Hierarchy Hell Self-Service: Data Access Provisioning Role Creation Delegation Building a Self-Service Portal Third-Party Solutions 6.3.4. Creating Your Own Blend of Data Access 6.4. Fine-Grained Data Access Control 6.4.1. Column-Based Access Control Static Cloning of Data Abstraction by Using Secure Views Dynamic Masking Column-Based Security for Semi-structured Data De-tokenization and Decryption 6.4.2. Row-Based Access Control Implementing Row-Level Security Static Copies Implementing Row-Level Security Using Secure Views Abstraction by Using Secure UDFs Row-Level Security in Semi-structured Data Snowflake Row Access Policies Hierarchical Row-Level Security 6.4.3. Combining Column and Row Security 6.4.4. Attribute-Based Access Control 6.4.5. Self-Service Access Control 6.4.6. Third-Party Solutions 6.5. Rolling Out Access Control Changes 6.6. Summary Chapter 7: Auditing and Monitoring 7.1. Snowflake Audits Characteristics 7.1.1. Every Operation Is Audited 7.1.2. Audits Are Available via… Snowflake 7.2. Snowflake Metadata 7.2.1. Account Usage vs. Information Schema 7.2.2. Relevant Views for Security in Snowflake.account_usage GRANTS_TO_ROLES Examples GRANTS_TO_USERS Examples LOGIN_HISTORY Examples SESSIONS Examples MASKING_POLICIES Examples POLICY_REFERENCES Examples QUERY_HISTORY Examples ROLES Examples STAGES Examples TASK_HISTORY Examples USERS Examples ACCESS_HISTORY Examples 7.2.3. The Reader Accounts Schema 7.2.4. Views in the Information Schema APPLICABLE_ROLES Examples ENABLED_ROLES OBJECT_PRIVILEGES Examples STAGES Examples TABLE_PRIVILEGES Examples Other Views 7.2.5. Table Functions in the Information Schema EXTERNAL_FUNCTIONS_HISTORY Examples LOGIN_HISTORY Examples LOGIN_HISTORY_BY_USER Examples POLICY_REFERENCES QUERY_HISTORY Examples QUERY_HISTORY_BY_* REST_EVENT_HISTORY Examples Other Table Functions 7.2.6. Use Cases Database Access Monitoring Examples Finding Admin Role Abuses Examples Monitoring Administrative Operations and Configuration Changes Examples Managing Overprivileged Users Examples Monitoring Usage of Vulnerable Drivers 7.3. Object Tagging 7.4. How to Monitor? 7.4.1. Using Tasks to Prepare Data Examples 7.4.2. Building a Snowsight Security Dashboard Failed Logins Tile Users Connecting from the Most IPs Tile Users with Admin Roles Tile 7.5. Alerting 7.5.1. Using Custom Scripting 7.5.2. Using Tasks and External Functions 7.5.3. Using SnowAlert 7.6. Using Third-Party Vendors for Monitoring, Auditing, and Alerting 7.7. Summary Chapter 8: Secure Data Sharing with Snowflake 8.1. Direct Share 8.1.1. Consuming Shared Data 8.1.2. Sharing Partial Data Using Secure Objects Using Secure Views Using Dynamic Secure Views Using Secure UDFs Using Secure Joins 8.2. Data Exchange and the Snowflake Data Marketplace 8.2.1. Managing Data Exchange 8.3. Reader Accounts 8.4. Distributed Data Clean Rooms 8.5. Summary Chapter 9: Snowflake for Security 9.1. How We Got Here 9.1.1. In Comes SIEM 9.1.2. Snowflake As a Security Data Lake 9.2. Why Snowflake for a Security Data Lake 9.2.1. Ease of Integration 9.2.2. Scalability and Features 9.2.3. Enrichments with Data Marketplace Sources 9.2.4. Sharing Is Easy 9.3. SnowAlert 9.3.1. Getting Started 9.3.2. Running SnowAlert 9.3.3. Managing SnowAlert 9.3.4. SnowAlert Data 9.4. Summary Epilogue Index