SecuPi Joins Snowflake Data Governance Accelerated Program
SecuPi is pleased to announce our addition to the Snowflake Data Governance Accelerated Program. This provides joint customers even more flexibility with an additional option for enforcing data access control and privacy compliance policy. SecuPi customers can use the same central Policy Management Server and policy administration GUI they are already familiar with but, now have the additional choice of having the Policy Enforcement Point (PEP) essentially embedded within Snowflake.
With SecuPi, the central Policy Management Server or Policy Definition Point (PDP) administers policy (rules) governing Attribute or Purpose Based Access Control (ABAC/PBAC), Data Protection (dynamic masking, encryption, tokenization, anonymization). These centrally managed policies are then consistently applied and enforced by distributed Policy Enforcement Points (PEP). The PDP also provides End-User Accountability, , Reporting, Threshold Monitoring, Alerting, User Behavior Analytics (UBA) and Privacy Compliance (RTBF, Restriction of Use, Records of Processing, etc.) by consolidating all data access logs from the various distributed PEP’s.
SecuPi already provides four (4) different methods for implementing PEP’s. This now adds a 5th method for Snowflake environments. All five methods are now potentially available for use on Snowflake depending on how Snowflake is used or accessed. The five methods include:
- Application Overlays – Instrument Java, Python, Node.JS & .NET Applications for maximum End-User visibility
- Smart Driver Wrappers – Transparently intercept ODBC/JDBC/ADO.NET connections to Databases
- In-Line Network Gateways – Network proxy for Postgres, MySQL, Snowflake Web Clients, JDBC, ODBC, ADO.NET, Python with direct connections
- SDK – Enables customers to build their own custom PEP’s, API calls, etc.
- Snowflake Native – Leverage Snowflake native security features to enforce PDP policy
Refer to the following URL for more information on this program:
https://www.snowflake.com/partners/governance-accelerated/?utm_cta=events-page-covid-notice
How It Works
Fine Grained access control policies are defined the same way in SecuPi. This new 5th method for implementing a SecuPi PEP simply enables automated enforcement directly within Snowflake where applicable. Recall that SecuPi can enforce PBAC and data protection based on virtually any User or Data Attribute and consistently apply rules at run-time across different Data Repositories and Applications On-Prem or in the Cloud.
This added PEP method supports policy enforcement whenever the User identity and all required User or Data attributes are available within the Snowflake environment. Situations where Shared Application ID’s are used to access the data on behalf of multiple concurrent End-Users will be limited to controlling access based on the Shared ID.
The same applies for Data attributes. For example, if there is a Column in a Customer Table that lists the Country that customer record belongs to, then a single policy can be generated in SecuPi that restricts access to records that match the Country(s) assigned to an End-User. SecuPi will simply generate a Row Level Policy and attach it to the table so that when users are accessing the Table it already includes the correct “WHERE” predicate to filter rows within Snowflake based on the matching Country tag or code.
In certain specific circumstances this 5th PEP method can be a useful or more efficient optional policy enforcement method. However, there are caveats to consider.
With SecuPi’s transparent Snowflake Gateway PEP for example, the same “View” with the same WHERE predicate can be generated dynamically at run-time without making any changes to Snowflake. Data access activity logging is also captured completely independent of Snowflake much like traditional Database Activity Monitoring (DAM) functionality but without the extra product, servers, network traffic, performance and administrative overhead.
With SecuPi’s unique Hold Your Own Key (HYOK) capability, any Encrypted or Tokenized columns remain protected in the Cloud and are only unprotected (re-identified) for authorized Users at run-time back On-Prem, or in your Virtual Private Network (VPN). The keys protecting the data are never available or accessible in the public or any shared Cloud environment. HYOK implementations result in minimal changes to the trust model for Cloud Migrations.
Following are detailed descriptions with screen shots showing configuration steps and data access results for SecuPi policy being enforced natively within Snowflake.
Set Dynamic Data Masking (DDM) and Encryption of Selected Columns
SecuPi leverages Snowflake’s Java User Defined Function (UDF) to enforce the same SecuPi managed policies directly within Snowflake. SecuPi managed policies can also be used to set access control, column-level dynamic masking and row-level filtering policies directly in Snowflake.
The following examples use 3 different Snowflake managed and defined roles and both the First Name and Email address Columns to describe how this works. Three different roles are defined:
FINANCE Can view encrypted First Name & Email Columns (referential integrity maintained).
PUBLIC Can only view masked First Name & Email address Columns (can be the default role).
HRDEMO_HR Can view both Name and Email address in the clear text.
When each of the different roles are selected or assigned to a User within Snowflake, they see only the data they are authorized to view in clear text.
Setting FINANCE Role in Snowflake
What FINANCE Role Members see
What PUBLIC Role Members see
What HRDEMO_HR Role Members See
SecuPi essentially deploys agents using Snowflake Java UDF’s
that then act like a PEP within Snowflake.
These UDF’s are then continuously updated when the configuration changes
and are self-contained within Snowflake (with no external dependency).
Data access control policies are defined within SecuPi using
the Native PEPs – Edit Native PEP Connection
menu option of SecuPi. Each time a
policy is changed and saved in SecuPi, it is automatically pushed to Snowflake.
Screen Shot showing setup of Native PEP Connection for Snowflake
Native Snowflake Masking Policies Managed from SecuPi
Another SecuPi – Snowflake Data Governance Accelerated
program integration is with Snowflake’s native masking capabilities. SecuPi can be used to manage masking policy within Snowflake.
The following screen shot displays output from the show masking policies command. The Admin User Kareene is a member of
the SECUPI_GOV role with permission to manage masking policies within
Snowflake. Two different masking
policies have been created. One to mask the Email Address Column and one to mask the Name Column.
Screen Shot showing Snowflake Native Masking Policies on Email and Name Columns
The following screen shot shows two masking policies, one
assigned to the First Name Column, and one assigned to the Email Column. Only authorized security admins (SECUPI_GOV
role) can view the Policy name, view or edit the description in Snowflake. All other Users only see “Unknown
Policy” assigned for these two Columns.
Screen Shot showing two Snowflake Native Masking Policies managed by SecuPi
Setting of the Snowflake Column-level masking for Columns is
managed automatically by SecuPi, and enforced natively in Snowflake. Users do
not need to “alter table” with masking policies nor do they need to maintain it
over time.
Snowflake native Column-level masking rules can also be
leveraged to perform decryption of data elements (like Email address) that are
encrypted or tokenized before loading to Snowflake. SecuPi’s ability to manage Snowflake UDF’s
enables this feature. The SecuPi created
UDF is called in place of a dynamic masking rule to decrypt for authorized
Users using the key embedded in the UDF.
This of course requires deploying the encryption key in the Cloud but
does enable local encrypt or decrypt operations to occur for specific use cases
where required. In fact, you can decide whether you want the Encryption Keys to
be deployed within Snowflake or, alternatively use an External User Defined
Function (UDF) where the keys are deployed outside of Snowflake.
NOTE: SecuPi also supports Column-Level Hold Your Own Key
(HYOK) encrypt and decrypt operations to occur within a SecuPi PEP such as the
SecuPi Gateway PEP for Snowflake Web Clients.
This approach is required for many different use cases where the ability
to encrypt or decrypt CANNOT exist in the Cloud. Cross border data flow restrictions and
common trust model requirements for example both demand this type of HYOK
approach.
Row-Level Filtering Based on Data Attributes
Row-level filtering can also be defined based on the
contents of any Column in a Snowflake Table.
A row-level rule and multiple Column-level masking or encryption rules
can be defined in SecuPi, then set and enforced in Snowflake natively. SecuPi can also fully support row-level
filtering based on other User or Data attributes besides User role membership
or data Column contents.
NOTE: A single Column cannot however have both a Column-level
dynamic masking and a Row-level filtering rule assigned in Snowflake. This would require applying the additional
controls within a SecuPi PEP such as the Snowflake Web Client Gateway PEP.
Leveraging Snowflake Tags for Access Control, Masking or
Filtering
Snowflake tags can be leveraged by SecuPi to manage Row and
Column-level access control policies within Snowflake. Snowflake Tag Lineage (or inheritance)
ensures that a tag assigned to a Table will also apply to all Columns in that
Table for example. If a Tag is assigned
to a Table or a Column, it will also be applied to any View created that
accesses that Table or Column. If a
Table (with a Tag) is copied within Snowflake, the Tag(s) will not follow the
Table (lineage). Although out of scope
for this discussion, SecuPi policy can be setup to enforce this lineage with
any rules applied to a Tag following the tagged data. Contact SecuPi sales support for more details
or a demo of this capability.
SecuPi can leverage these Snowflake tags in SecuPi managed
policies that are then enforced natively within Snowflake. SecuPi retrieves the tag information via a
SELECT statement on the Tag Table.
SecuPi can be setup to automatically poll or query the Snowflake Tag
Table on a pre-defined interval. This
interval should be set to an equal or longer time interval than the Snowflake
Tag Table update interval which can be as long as once every 10 minutes or more.
The following screen shot shows a SELECT statement output
reading Tag information from the Snowflake Tag Table. This Snowflake Tag information is imported
into the SecuPi Policy Management Server or Policy Definition Point (PDP) and
leveraged as needed in applying access control, dynamic masking, encryption or
row filtering based on the Snowflake Tags.
Screen Shot showing Snowflake Tags
The Snowflake Tag information is then imported into SecuPi
under Resource Access. The following screen shot then shows the Snowflake Tags being leveraged in configuring SecuPi Policy. SecuPi will import this information in its entirety each time it retrieves the Tag information from Snowflake. Any configured rules will remain the same and applied to the Tags in the same way for both native controls in Snowflake or any additional SecuPi PEP enforced rules.
The following screen shot shows configuring a SecuPi native
Snowflake PEP connection. Clicking on
the Import Resources button initiates reading the Snowflake Tags. This can ad hoc or be configured to occur at a regular pre-defined time interval.
Screen Shot of SecuPi Policy Management Server importing Snowflake Tags
SecuPi will then import any Tags defined as a SecuPi Resource using the Tag Name. SecuPi can either import the entire Tag Table or only selected Tags.
Other Snowflake Data Governance Accelerated Program Integration Points
SecuPi has integration with other Snowflake features in the product roadmap including retrieving and using Snowflake data access History data. SecuPi PEP’s already capture all access to sensitive or regulated data on Snowflake or any other data repository On-Prem or Cloud Hosted provided that SecuPi is deployed as a gateway or Smart Driver PEP. Retrieving Snowflake data access History data may be of value in evaluating or tracking any direct access to data within the Cloud environment by Snowflake system admins for example. Other integration points will be based on joint customer demand.
In Summary
SecuPi provides maximum flexibility in access control, data protection and privacy compliance policy creation and enforcement options. Centrally managed and controlled policy is consistently enforced across data repositories and applications used to access the data for both On-Prem and Hybrid Cloud environments including Snowflake. SecuPi’s ability to now also enforce SecuPi policy within Snowflake using native access controls and data security functionality such as Column-level dynamic masking, decryption, Row-Level filtering enables additional configuration options. These can now be used to address specific data security, privacy compliance or data protection use cases where this approach is more applicable. This is now the 5th PEP implementation method supported by SecuPi.
With SecuPi, this is not an either/or decision. Customers are free to utilize whatever PEP method is most appropriate for each specific use case. All controlled by the same centrally managed policies and all sharing the same centrally managed audit trail and accountability.
Contact SecuPi for more information or to arrange a demo of available Snowflake-SecuPi integration options.