SecuPi is part of the Snowflake Horizon Partner Ecosystem

SecuPi is pleased to be a part of the Snowflake Horizon partner ecosystem. Snowflake Horizon is Snowflake’s built-in governance solution with a unified set of compliance, security, privacy, interoperability, and access capabilities. Snowflake Horizon makes it easy for customers to govern and take immediate action on data, apps, and more across clouds, teams, partners, and customers — both inside and outside of organizations.

With Snowflake Horizon’s, customers have access to SecuPi providing enhanced interoperability and flexibility with native enforcement of data access policies, real-time visibility, security, privacy & sovereignty use cases across data platforms. Customers can use the SecuPi’s central Policy Management Server and policy administration GUI with the additional choice of having the SecuPi enforcer essentially embedded within Snowflake.

SecuPi supports three major advancements in Snowflake Horizon:

1. Expansion of Snowflake to become the enterprise data security event hub of all Cloud workloads with its expansion of sensitive data discovery and classification is now coupled with SecuPi Data Security platform to apply remediation back at the source Cloud data platforms using its 5(!) overarching access control and de-identification Enforcer techniques
2. Snowflake new sensitive data lineage from operational data sources to destination imposes the fiduciary requirement to apply de-identification, encryption and tokenization to address data sovereignty and privacy requirements. The SecuPi ETL Enforcers, deployed on Kafka, Glue, Azure Data Factory, Talend to name a few, applies masking, hashing, encryption and tokenization on critical data on-premises and in-country.
3. The SecuPi client-side encryption Enforcer for Snowflake ensures that the data is always encrypted, with full Segregation of Duties (SoD), only to be decrypted at the authorized client application.

With SecuPi, the central Policy Management Server administers policy (rules) governing Attribute or Purpose Based Access Control (ABAC/PBAC), Data Protection (dynamic masking, encryption, tokenization, anonymization) directly within Snowflake and other data platforms in use. These centrally managed policies are then consistently applied and enforced by distributed Enforcers. The SecuPi Management Server also provides end-user accountability, reporting, threshold monitoring, alerting, user behavior analytics (UBA), and privacy compliance (RTBF), restriction of use, records of processing, etc.) by consolidating all data access logs from the various distributed Enforcers.

SecuPi has already been providing four (4) different methods for implementing data access control and security enforcement and is now offering a 5^th method for Snowflake environments. All five methods are now available for use by Snowflake customers, addressing the various Snowflake deployment options and purposes.

The five methods include:

• Application Overlays – instrumenting Java, Python, Node.JS & .NET Applications for maximum End-User visibility.
• Smart Driver Wrappers – Transparently intercepting ODBC/JDBC/ADO.NET connections to Databases.
• In-Line Network Gateways – Network proxy for Postgres, MySQL, Snowflake Web Clients, JDBC, ODBC, ADO.NET, and Python with direct connections.
• SDK – Enabling customers to build their own custom Enforcers, API calls, etc.
• Snowflake Native – Leverage Snowflake native security features to enforce data protection policies.

Automated Enforcement Directly within Snowflake – How It Works

Fine-grained access control policies and data de-identification policies are defined in the same way in the SecuPi management server. The newly introduced 5^th method for implementing a SecuPi Enforcer enables automated enforcement directly within Snowflake where applicable, with SecuPi enforcing PBAC, de-identification and data protection at-rest and in-use, ensuring the consistent application of rules at runtime across various data repositories and applications, whether they are on-prem or in the cloud.

The newly introduced method supports policy enforcement whenever the user identity and all required user or data attributes are available within the Snowflake environment. Situations, where Shared Application IDs are used to access the data on behalf of multiple concurrent end-users, will be limited to controlling access based on the Shared ID.

The same applies to Data attributes. For example, if there is a Column in a Customer Table that includes the Country that the customer record belongs to, then a single policy can be generated in SecuPi to restrict access to records that match the Country(s) assigned to an end user. SecuPi will simply generate a Row Level Policy and attach it to the table so that when users access the Table, it already includes the correct “WHERE” predicate to filter rows within Snowflake based on the matching Country tag or code.

In certain specific circumstances, this method can be a useful or more efficient policy enforcement method. However, there are caveats to consider:

• With SecuPi’s transparent Snowflake Gateway Enforcer, for example, the same “View” with the same “WHERE” predicate can be generated dynamically at run-time without making any changes to Snowflake. Data access activity logging is also captured completely independently of Snowflake; much like traditional Database Activity Monitoring (DAM) functionality but without the extra product, servers, network traffic, performance and administrative overhead.
• With SecuPi’s unique Hold Your Own Key (HYOK) capability, any Encrypted or Tokenized columns remain protected in the Cloud and are in the clear (re-identified) only for authorized Users at run-time back On-Prem, or in your Virtual Private Network (VPN). The keys protecting the data are never available or accessible in the public or any shared Cloud environment. HYOK implementations result in minimal changes to the trust model for Cloud Migrations.

Following are detailed descriptions with screenshots showing configuration steps and data access results for SecuPi policy being enforced natively within Snowflake.

Set Dynamic Data Masking (DDM) and Encryption of Selected Columns, Rows and Fields

SecuPi leverages Snowflake’s Java User Defined Function (UDF) to enforce the same SecuPi-managed policies directly within Snowflake. SecuPi managed policies can also be used to set access control, column-level dynamic masking, and row-level filtering policies directly in Snowflake.

The following examples use 3 different Snowflake-managed and defined roles and both the “First Name” and “Email address” columns to describe how this works. Three different roles are defined:

FINANCE – Can view encrypted “First Name” and “Email Address” columns (referential integrity maintained).

PUBLIC – Can only view masked “First Name” and “Email Address” columns (can be the default role).

HRDEMO_HR – Can view both “First Name” and “Email Address” in the clear text.

When each of the different roles is selected or assigned to a User within Snowflake, they see only the data they are authorized to view in clear text.

When each of the different roles are selected or assigned to a User within Snowflake, they see only the data they are authorized to view in clear text.

Setting FINANCE Role in Snowflake

What FINANCE Role Members see

What PUBLIC Role Members see

What HRDEMO_HR Role Members See

SecuPi essentially deploys agents using Snowflake Java UDF’s
that then act like an enforcer within Snowflake. 
These UDF’s are then continuously updated when the configuration changes and are self-contained within Snowflake (with no external dependency). 

Data access control policies are defined within SecuPi using the Native Enforcer – Edit Native Connection menu option of SecuPi. Each time a policy is changed and saved in SecuPi, it is automatically propagated to Snowflake for execution.

 Screenshot showing the setup of Native Enforcer Connection for Snowflake

Native Snowflake Masking Policies Managed from SecuPi

Another SecuPi – Snowflake Data Governance Accelerated
program integration is with Snowflake’s native masking capabilities. SecuPi can be used to manage masking policy within Snowflake.

The following screenshot displays output from the show masking policies command. The Admin User Kareene is a member of the SECUPI_GOV role with permission to manage masking policies within Snowflake. Two different masking policies have been created. One to mask the Email Address Column and one to mask the Name Column. 

Screen Shot showing Snowflake Native Masking Policies on Email and Name Columns

The following screenshot shows two masking policies, one assigned to the First Name Column, and one assigned to the Email Column. Only authorized security admins (SECUPI_GOV role) can view the Policy name, view or edit the description in Snowflake. All other Users only see “Unknown Policy” assigned for these two Columns. 

Screenshot showing two Snowflake Native Masking Policies managed by SecuPi

Setting of the Snowflake Column-level masking for Columns is
managed automatically by SecuPi, and enforced natively in Snowflake. Users do not need to “alter table” with masking policies nor do they need to maintain it over time.

Snowflake native Column-level masking rules can also be
leveraged to perform decryption of data elements (like Email address) that are encrypted or tokenized before loading to Snowflake. SecuPi’s ability to manage Snowflake UDF’s enables this feature. The SecuPi created UDF is called in place of a dynamic masking rule to decrypt for authorized users using the key embedded in the UDF. 
This of course requires deploying the encryption key in the Cloud but does enable local encrypt or decrypt operations to occur for specific use cases where required. In fact, you can decide whether you want the Encryption Keys to be deployed within Snowflake or, alternatively use an External User Defined Function (UDF) where the keys are deployed outside of Snowflake.

NOTE: SecuPi also supports Column-Level Hold Your Own Key (HYOK) encrypt and decrypt operations to occur within a SecuPi enforcer, such as the SecuPi Gateway enforcer for Snowflake Web Clients. 
This approach is required for many different use cases where the ability to encrypt or decrypt CANNOT exist in the Cloud. Cross border data flow restrictions and common trust model requirements for example both demand this type of HYOK
approach. 

Row-Level Filtering Based on Data Attributes

Row-level filtering can also be defined based on the contents of any Column in a Snowflake Table. A row-level rule and multiple Column-level masking or encryption rules can be defined in SecuPi, then set and enforced in Snowflake natively. SecuPi can also fully support row-level filtering based on other User or Data attributes besides User role membership or data Column contents.

NOTE: However, it’s important to note that a single column cannot have both a column-level dynamic masking and a row-level filtering rule assigned in Snowflake. To address this, additional controls need to be applied within a SecuPi Enforcer, like the Snowflake Web Client Gateway Enforcer.

Leveraging Snowflake Tags for Access Control, Masking or Filtering

Snowflake tags can be leveraged by SecuPi to manage Row and Column-level access control policies within Snowflake. Snowflake Tag Lineage (or inheritance) ensures that a tag assigned to a Table will also apply to all Columns in that Table for example. If a Tag is assigned to a Table or a Column, it will also be applied to any View created that accesses that Table or Column. If a Table (with a Tag) is copied within Snowflake, the Tag(s) will not follow the Table (lineage). Although out of scope for this discussion, SecuPi policy can be set up to enforce this lineage with any rules applied to a Tag following the tagged data. Contact SecuPi sales support for more details or a demo of this capability.

SecuPi can leverage these Snowflake tags in SecuPi-managed policies that are then enforced natively within Snowflake. SecuPi retrieves the tag information via a SELECT statement on the Tag Table. SecuPi can be set up to automatically poll or query the Snowflake Tag Table on a pre-defined interval. This interval should be set to an equal or longer time interval than the Snowflake Tag Table update interval which can be as long as once every 10 minutes or more.

The following screenshot shows a SELECT statement output reading Tag information from the Snowflake Tag Table. This Snowflake Tag information is imported into the SecuPi Policy Management Server and leveraged as needed in applying access control, dynamic masking, encryption, or row filtering based on the Snowflake Tags.

Screenshot showing Snowflake Tags

The Snowflake Tag information is then imported into SecuPi under Resource Access.  The following screenshot then shows the Snowflake Tags being leveraged in configuring SecuPi Policy. SecuPi will import this information in its entirety each time it retrieves the Tag information from Snowflake. Any configured rules will remain the same and applied to the Tags in the same way for both native controls in Snowflake or any additional SecuPi Enforcer enforced rules.

The following screenshot shows configuring a SecuPi native Snowflake enforcer connection. Clicking on the Import Resources button initiates reading the Snowflake Tags. This can ad hoc or be configured to occur at a regular pre-defined time interval. 

Screen Shot of SecuPi Policy Management Server importing Snowflake Tags

 SecuPi will then import any Tags defined as a SecuPi Resource using the Tag Name. SecuPi can either import the entire Tag Table or only selected Tags.

 Other Snowflake Data Governance Accelerated Program Integration Points  

SecuPi has integration with other Snowflake features in the product roadmap including retrieving and using Snowflake data access History data. SecuPi Enforcers already capture all access to sensitive or regulated data on Snowflake or any other data repository On-Prem or Cloud Hosted provided that SecuPi is deployed as a gateway or Smart Driver Enforcer. Retrieving Snowflake data access History data may be of value in evaluating or tracking any direct access to data within the Cloud environment by Snowflake system admins for example. Other integration points will be based on joint customer demand.

In Summary

SecuPi provides maximum flexibility in access control, data protection and privacy compliance policy creation and enforcement options. The centrally managed and controlled policy is consistently enforced across data repositories and applications used to access the data for both On-Prem and Hybrid Cloud environments including Snowflake. SecuPi’s ability to now also enforce SecuPi policy within Snowflake using native access controls and data security functionality such as Column-level dynamic masking, decryption, Row-Level filtering enables additional configuration options.  These can now be used to address specific data security, privacy compliance or data protection use cases where this approach is more applicable. This is now the 5^th enforcer implementation method supported by SecuPi. 

With SecuPi, this is not an either/or decision. Customers are free to utilize whatever enforcer method is most appropriate for each specific use case. All controlled by the same centrally managed policies and all sharing the same centrally managed audit trail and accountability.

Co-authored by:

Ravi Kumar
Senior Partner Sales Engineer, Snowflake

Avihai Segal
Head of Partnerships and Alliances, SecuPi