Detections
Analytics

4.10 Ensure that data masking is enabled for sensitive data

Information

Data masking policy is a fine-grained access control used to protect sensitive data from unauthorized access by selectively masking plain-text data in table and view columns at query time.

Masking policy allows for a wide range of use cases where data can be queried, aggregated and analyzed in a privacy preserving manner.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Identify columns with sensitive data across all account tables and views and apply appropriate masking policies following steps described in the documentation https://docs.snowflake.com/en/user-guide/security-column-intro.

If columns with sensitive data are tagged appropriately, tag-based masking can be used.

Sensitive data columns can be identified and tagged with assistance of the EXTRACT_SEMANTIC_CATEGORIES and ASSOCIATE_SEMANTIC_CATEGORY_TAGS system functions. See the Data Classification documentation https://docs.snowflake.com/en/user-guide/governance-classify-concepts for details.

To create a data masking policy, follow the steps in this documentation https://docs.snowflake.com/en/sql-reference/sql/create-masking-policy.

Impact:

Manual and automated workflows relying on querying unmasked data may be broken unless updated prior to application of a masking policy.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), CSCv7|14

Plugin: Snowflake

Control ID: 14d8363853ab4d30b2ee3808abf524257b587e28543943da6935ff227f780c56