Detections
Analytics

2.3 Ensure monitoring and alerting exist for password sign-ins of SSO users

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The security benefit of SSO is to relieve users from having to set up and manage distinct sets of credentials for distinct applications and services. It also allows security administrators to focus on hardening and defending only one identity storage and limited number of user credentials.

Allowing users to sign in with Snowflake passwords in the presence of a configured third-party identity provider SSO may undermine mandatory security controls configured on the SSO and degrade security posture of the account. For example, the SSO sign-in flow may be configured to require multi-factor authentication (MFA), where Snowflake password sign-in flow may not.

Every Snowflake password-based sign-in may indicate an unapproved authentication flow taking place.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 -

Configure your security monitoring solution to alert on password sign-ins of SSO users. The following query can be run periodically.

select event_timestamp, user_name, client_ip, reported_client_type, reported_client_version, first_authentication_factor, second_authentication_factorfrom snowflake.account_usage.login_historywhere first_authentication_factor = 'PASSWORD'order by event_timestamp desc;

Impact:

If password sign-in events happen frequently, monitoring and alerting on this event may generate undue load on the detection and response team.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|6.7

Plugin: Snowflake

Control ID: e851dcff9623b8b7747b56f3e7cd6fc70c22b24c0214ad1a2b85c47ee9792a50