Slide 1: Snowflake Security
SNOWFLAKE SECURITY © 2019 Snowflake Computing Inc. All Rights Reserved
Slide 2: Snowflake Security at a Glance
SNOWFLAKE SECURITY AT A GLANCE Enterprise for Sensitive Data (ESD) Snowflake Operational Controls • FedRAMP / NIST 800-53 • ISO/IEC 27001 • HIPAA Access • SOC2 Type 2 • PCI • SOC1 Type 2 • All communication secured & encrypted Authentication • TLS 1.2 encryption for all client communications • Passw
Slide 3: Snowflake Security at a Glance: Deployment
SNOWFLAKE IaaS Region SECURITY AT A GLANCE Snowflake Deployment Snowflake Multi-Tenant Pod Customer Environment (VNET/VPC/On-Prem) Load Balancer Cloud Gateway Cloud Services Metadata Store Snowflake VNET / Tri-Secret Secure Customer VPC Virtual Managed Keys (Bring Your Own Key enabled) Warehouses Se
Slide 4: Access – Secure Communication
ACCESS – SECURE COMMUNICATION ODBC JDBC Web UI Custom All communication encrypted end-to-end ● Web UI, command line client, and drivers communicate solely over HTTPS ● Connections encrypted using TLS 1.2 from client through to Snowflake Service ● Data encrypted at rest HTTPS All access controlled ●
Slide 5: Application Security
APPLICATION SECURITY Authorization Control ● Role-based authorization Users ● Authorization for access to all database Role 1 objects—databases, schemas, tables… View tables X, Y Use warehouse A ● Authorization for operations in Snowflake—create, stop & start virtual warehouses ● DAC and RBAC info A
Slide 6: Hierarchical Encryption for Data at Rest
HIERARCHICAL ENCRYPTION FOR DATA AT REST Hierarchical Key Model using Tri-Secret Secure Key Rotation & Re-Keying • Data is encrypted by default, - no configuration required • Hierarchical key model rooted in HSM • Tri-Secret Secure • Keys rotated programmatically by Snowflake • All data re-encrypted
Slide 7: Account Logging & Monitoring
ACCOUNT LOGGING & MONITORING Customers may audit users, access, and query activity related to their data. • LOGIN_HISTORY • QUERY_HISTORY • Availability for up to 7 days in functions; 365 days in views in the past • Export through JDBC or as JSON for use in SIEM https://www.snowflake.com/use-cases/m
Slide 8: Infrastructure Logging & Monitoring
INFRASTRUCTURE LOGGING & MONITORING Snowflake uses advanced threat detection tools to monitor production infrastructure ● Failed logins ● File integrity monitoring ● Unauthorized system modifications Snowflake also uses behavioral monitoring tools to monitor a baseline of production infrastructure b
Slide 9: Time Travel & Fail Safe
TIME TRAVEL & FAIL SAFE Time Travel ● Select from data as it existed in the past, e.g. before some specific event ● Up to 90 days Fail Safe ● Request recovery of lost data ● Up to 7 days for most objects More on Time Travel & Fail Safe © 2019 Snowflake Computing Inc. All Rights Reserved
Slide 10: Secure SDLC
SECURE SDLC Snowflake has developed a Secure Software Development Lifecycle (SDLC) ● Follows the Microsoft threat modeling SDLC and incorporates elements of OWASP ● All Snowflake development personnel are trained on Snowflake Secure SDLC ● All changes must be documented ● All changes are reviewed fo
Slide 11: Compliance
COMPLIANCE Third Party Attestations and Certifications SOC 1 Type II PCI-DSS ISO/IEC 27001 FedRAMP HIPAA 6 month Coverage Period (Available from OMB/MAX) (HITRUST in Progress) SOC 2 Type II 12 Month Coverage Period Self-Assessments CAIQ, SIG, Pen Test Results © 2019 Snowflake Computing Inc. All Righ
Slide 12: GDPR – General Data Protection Regulation
GDPR – GENERAL DATA PROTECTION REGULATION What it is ● GDPR is a new EU regulation that becomes effective on May 25, 2018 ● Governs the protection and processing of EU personal data What it means in the context of Snowflake Different requirements apply to different types of entities ● Controller – S
Slide 13: Additional Collateral
ADDITIONAL COLLATERAL Snowflake Security Product Documentation The above link provides information on how to configure: ● Network Policies ● MFA, IP Whitelisting ● Federated Authentication / SSO ● Access Control (DAC, RBAC) ● Best Practices ● Audit Logs © 2019 Snowflake Computing Inc. All Rights Res
Slide 14: Thank You
THANK YOU © 2019 Snowflake Computing Inc. All Rights Reserved