Recent Breaches: A Wake-Up Call for Shared Responsibility

As Snowflake’s adoption soars, CISOs must prioritize securing access to this critical platform. While Snowflake continuously enhances its security, the ultimate responsibility for protecting data lies with CISOs and their teams. Recent breaches, like the AT&T incident affecting 110 million customers, highlight serious vulnerabilities and underscore the need for robust security measures.

Understanding the Shared Responsibility Model

Snowflake operates under a shared responsibility model, offering guidance on best practices, but customers must implement these measures effectively. CISOs should consider leveraging third-party tools for granular visibility and control over permissions, helping to enforce least privilege and mitigate risks in large-scale deployments.

Challenges in Securing Snowflake Environments

Securing a Snowflake environment starts with knowing exactly who has access to what—a task that’s far from simple. Key challenges include:

• Complex RBAC: Snowflake’s role-based access control (RBAC) includes over 50 privilege types and a dozen object types, making even basic privilege statements tough to decode without deep expertise.
• Enterprise Scale: With thousands of users and hundreds of thousands of tables, schemas, and views, managing access across a large-scale deployment is daunting.
• Siloed Access Data: Organizations often use Identity Providers to manage Snowflake access, creating a disconnect that makes it hard to see who truly has access.
• Pressure on Access Provisioning: The demand for quick access in fast-paced environments leads to over-provisioning and inadequate due diligence.

The Role Sprawl Dilemma

Additionally, many large, regulated organizations quickly encounter the issue of “Role Sprawl,” where cloud platforms have more roles than end-users, leading to delays and frustration in provisioning data sets to analysts and data scientists. Role Sprawl arises from the growth of sensitive data, an increasing number of users, policies requiring hierarchical tags that dramatically increase complexity, and the addition of attributes for access authorization.

Moving Towards a Least Privilege Model

CISOs should invest in tools that offer granular visibility into object-level permissions. This visibility is crucial for spotting unintended access, uncovering misconfigurations, and moving towards a least privilege model. Business unit leaders often prioritize speed and efficiency over strict access controls, unintentionally expanding the attack surface and heightening the risk of data breaches. This puts security teams in a tough spot, having to balance agility with the need for rigorous security measures to protect sensitive data.

Optimizing RBAC Implementation

Resolving Role Sprawl requires shifting to Attribute-Based Access Control (ABAC), achieving:

• Reduction of 50% in the number of roles while retrofitting them to actual usage (“least privilege”)
• Simplifying complex or hierarchical roles while eliminating bloated roles with excessive access
• Removing dormant or duplicate roles to simplify structures
• Splitting generic roles into more targeted, less privileged ones
• Right-sizing roles based on actual usage data
• Eliminating super-privileged roles

Ensuring Ongoing Security and Compliance

Reducing data breaches, compliance failures, and unnecessary costs requires continuous focus on real-time monitoring and enforcing least privilege with Attribute-Based Access Control in Snowflake and other cloud data platforms.

Want to learn more about the The Right Way to Scale Access Control Implementing ABAC & Format Preserving Encryption (FPE)?

Read our recent joint blog post with Mike Mitrowski, Snowflake Global Field CTO:

The Right Way to Scale Access Control Implementing ABAC & Format Preserving Encryption (FPE)