Detections
Analytics

1.4 Ensure that person users do not use password-only authentication

Information

Multi-factor authentication (MFA) is a security control used to add an additional layer of login security. It works by requiring the user to present two or more proofs (factors) of user identity. An MFA example would be requiring a password and a verification code delivered to the user's phone during user sign-in.

Snowflake supports multiple forms of MFA, with passkeys and authenticator apps being preferred, in addition to Duo.

NOTE: Person users are those with their TYPE set to PERSON or null.

MFA mitigates security threats of users creating weak passwords and user passwords being stolen or accidentally leaked.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Programmatically :

For active users, create or update an authentication policy at the account level to enforce MFA for all password-based logins across all Snowflake interfaces.

 CREATE AUTHENTICATION POLICY enforce_password_mfa
 -- Require MFA enrollment when logging in with username and password
 MFA_ENROLLMENT = REQUIRED;

 ALTER ACCOUNT SET AUTHENTICATION POLICY enforce_password_mfa;

For inactive users, consider disabling or dropping the user if they are no longer in use. If the user is being used for break-glass scenarios, enable OTP as a second factor https://docs.snowflake.com/en/user-guide/security-mfa#setting-up-administrators-for-break-glass-access.

If the user is using their password to connect to Snowflake via an application, upgrade the user's connection with the app to use a strong, preferred authentication method. Consult the Overview of Snowflake Authentication guidance https://docs.snowflake.com/en/user-guide/security-authentication-overview for details on recommended authentication methods.

From the UI:

 - Go to https://app.snowflake.com/and sign into your Snowflake account.
 - On the left side navigation bar, hover over Governance & security, then click on Trust Center.
 - On the Strong authentication progress tile, click on View hub.
 - Under Prioritize your remediation efforts, select By user. Under the User type filter, select Person.
 - For each user listed, click on the user name and follow the recommended remediation instructions.

Impact:

An authentication policy requiring MFA may break existing automation connecting to Snowflake using only passwords.
Be sure that all users in the account are correctly tagged as PERSON or SERVICE to avoid disruption to essential services.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), 800-53|IA-2(2), CSCv7|4.5, CSCv7|16.3

Plugin: Snowflake

Control ID: 48f207d6e89b58ad041c7fa63c01c67b07dcfa6c2f760736ff416440b4a73558