Detections
Analytics

1.4 Ensure multi-factor authentication (MFA) is turned on for all human users with password-based authentication

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Multi-factor authentication (MFA) is a security control used to add an additional layer of login security. It works by requiring the user to present two or more proofs (factors) of user identity. An MFA example would be requiring a password and a verification code delivered to the user's phone during user sign-in.

The MFA feature for Snowflake users is powered by the Duo Security service.

MFA mitigates security threats of users creating weak passwords and user passwords being stolen or accidentally leaked.

Solution

Users have to individually enroll into MFA using the Snowflake web UI.

From the UI:

 - Each user with a password should go to

https://app.snowflake.com/

and sign into their Snowflake account.
 - Click on the username on the top left side.
 - Click on Profile
 - Next to Multi-factor authentication click Enroll
 - Click Start setup
 - Select the type of device and click Continue
 - Follow the steps to finish the enrollment.

If MFA needs to be enabled for a large population of users, consider prioritizing users with ACCOUNTADMIN SECURITYADMIN or other highly privileged roles.

For specific instructions, see the documentation page

Enrolling in MFA (Multi-Factor Authentication)

.

Note : If you use SSO authentication, you will have to check and configure MFA with your Identity Provider.

Impact:

If users lose access to the second factor of authentication, an account admin may need to reset their access.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|4.5, CSCv7|16.3

Plugin: Snowflake

Control ID: f001e7a28a9fdc6e7503f28f22f604a5d3ece0965b4d2a0749c082a3ecbc7e42