Detections
Analytics
2.4 Ensure monitoring and alerting exist for password sign-in without MFA
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Multi-factor authentication (MFA) is a security control used to add an additional layer of login security. It works by requiring the user to present two or more proofs (factors) of user identity. An MFA example would be requiring a password and a verification code delivered to the user's phone during user sign-in.The MFA feature for Snowflake users is powered by the Duo Security service.
MFA mitigates security threats of users creating weak passwords and user passwords being stolen or accidentally leaked.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Programmatically:In a Snowsight worksheet or through the SnowSQL CLI:
-
Configure your security monitoring solution to alert on password sign-ins without MFA. The following query can be run periodically.
select event_timestamp, user_name, client_ip, reported_client_type, reported_client_version, first_authentication_factor, second_authentication_factorfrom snowflake.account_usage.login_historywhere first_authentication_factor = 'PASSWORD' and second_authentication_factor is null order by event_timestamp desc;
Impact:
If password sign-in events without MFA happen frequently, monitoring and alerting on this event may generate undue load on the detection and response team.
See Also
Item Details
Audit Name: CIS Snowflake Foundations v1.0.0 L1
References: CSCv7|6.7
Plugin: Snowflake
Control ID: edce3168c0b265e721a5dba44de2f538159d5a749c171c679150138ab1271dc4