Detections
Analytics

2.9 Ensure monitoring and alerting exists for changes to authentication policies and associated objects

Information

Authentication policies allow restricting authentication constraints such as:
Whether person users must enroll in MFA
Which authentication methods require MFA
The allowed authentication methods, such as SAML, passwords, OAuth, key pair authentication, and programmatic access tokens.
The allowed SAML2 security integrations
The types of clients allowed to connect to Snowflake
Whether network policies are required when using programmatic access tokens

Snowflake supports setting an authentication policy for your Snowflake account and for
individual users. If an authentication policy exists for the account and a user in the same account, the user-level authentication policy takes precedence over the account-level authentication policy.

Changes to authentication policies could weaken the account's authentication requirements, such as relaxing restrictions on allowed driver versions and client applications and requirements when authenticating with Programmatic Access Tokens or Workload Identity Federation.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

In a Snowsight worksheet or through the SnowSQL CLI:

 - Configure your security monitoring solution to alert on changes to authentication policies.
 SELECT END_TIME,
 QUERY_TYPE,
 QUERY_TEXT,
 USER_NAME,
 ROLE_NAME
 FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
 WHERE EXECUTION_STATUS = \\'SUCCESS\\'
 AND (QUERY_TYPE IN (\\'CREATE_AUTHENTICATION_POLICY\\', \\'ALTER_AUTHENTICATION_POLICY\\',
 \\'DROP_AUTHENTICATION_POLICY\\')
 OR (QUERY_TEXT ILIKE \\'%SET%AUTHENTICATION_POLICY%\\'
 OR QUERY_TEXT ILIKE \\'%UNSET%AUTHENTICATION_POLICY%\\')
 )
 ORDER BY END_TIME DESC;

Impact:

If authentication policy creation, update, deletion and object association events happen frequently, monitoring and alerting on this event may generate undue load on the detection and response team.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6, 800-53|AU-6(1), 800-53|AU-7(1), CSCv7|6.7

Plugin: Snowflake

Control ID: 4ec1b3872ed21ffd7ff18e776412a9edd64da8f0ba717c8f6ac3ef32efa77ec1