Detections
Analytics

1.6 Ensure that legacy service users are migrated to service users

Information

Service users are used by scripts, jobs, applications, pipelines, etc. to talk to Snowflake.

Snowflake distinguishes between person and service users through the 'type' property. Service users can have their type set to 'SERVICE' or 'LEGACY_SERVICE.' Legacy service users, unlike service users, are allowed to use password-based authentication. Snowflake is deprecating the LEGACY_SERVICE user type, and all users should move away from password-based authentication.

Password-based authentication has a set of disadvantages that increase probability of a security incident, especially when used without MFA:

 - Passwords created by humans are generally more predictable and less random than keys generated by a computer. Consequently, passwords are easier to brute force both online (against a live service) or offline (against a hashed password database).
 - Passwords are usually transmitted over the network and can be leaked when the transmission channel is insecure or when an application is accidentally misconfigured to log passwords.
 - Passwords are easier to leak by writing them down on a sticky note attached to the back of a keyboard.
 - It is easier to trick (phish) a user into revealing their password to an unauthorized party.

Using more secure authentication options, such as Workload Identity Federation, and OAuth helps with mitigating the aforementioned issues.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically:

For users connecting through cloud workloads running in GCP, Azure, or AWS, we strongly recommend using secretless authentication through Workload Identity Federation https://docs.snowflake.com/en/user-guide/workload-identity-federation.

For users connecting through other applications, upgrade the user's connection in these applications to use a strong, preferred authentication method. Consult the application authentication support guidance and learn about preferred authentication methods https://docs.snowflake.com/en/user-guide/security-authentication-overview to connect to Snowflake.

For inactive users, consider disabling or dropping the user if they are no longer in use. If the user is being used for break-glass scenarios, enable OTP as a second factor https://docs.snowflake.com/en/user-guide/security-mfa#setting-up-administrators-for-break-glass-access.

From the UI:

 - Go to https://app.snowflake.com/and sign into your Snowflake account.
 - On the left side navigation bar, hover over Governance & security, then click on Trust Center.
 - On the Strong authentication progress tile, click on View hub.
 - Under Prioritize your remediation efforts, select By user. Under the User type filter, select Legacy Service.
 - For each user listed, click on the user name and follow the recommended remediation instructions.

Impact:

An authentication policy requiring MFA may break existing automation connecting to Snowflake using only passwords. Be sure that all users in the account are correctly tagged as PERSON or SERVICE to avoid disruption to essential services.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Snowflake

Control ID: 19a3dd1519de78cb0b9f730fedd8d7e1e8eefc300a55751c0412811d59e52e2e