New Snowflake Compliance Plugin and Audit files

Summary

Customers can now measure compliance against the Snowflake Platform with new plugin ID Snowflake Compliance Checks (206112) on Tenable Vulnerability Management and Nessus. This plugin is published as a part of the Audit Cloud Infrastructure compliance template and will use a new credential type of Snowflake API. The plugin will retrieve all target data using the Snowflake SQL API and will evaluate actual values against a given audit policy.

Two audits implementing the CIS benchmark will be released along with the plugin:

• CIS Snowflake Foundations v1.0.0 Level 1
• CIS Snowflake Foundations v1.0.0 Level 2

These audits contain a total of 39 checks across 2 profiles with 20 checks being fully automated. Some examples include:

• Identity and Access Management
  • 1.2 Ensure Snowflake SCIM integration is configured to automatically provision and deprovision users and groups (i.e. roles)
  • 1.7 Ensure authentication key pairs are rotated every 180 days
  • 1.8 Ensure that users who did not log in for 90 days are disabled
• Data Protection
  • 4.1 Ensure yearly rekeying is enabled for a Snowflake account
  • 4.5 Ensure that the REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION account parameter is set to true

Additional Notes

For those that are interested in creating custom audit content for their environment, the audit supports the following structure.

<check_type: "Snowflake">

  <custom_item>

    type            : SQL_POLICY

    description  : "Ensure yearly rekeying is enabled for a Snowflake account"

    sql_request : "SHOW PARAMETERS LIKE 'PERIODIC_DATA_REKEYING' IN ACCOUNT;"

    sql_types    : REGEX, REGEX, REGEX_OR_NULL, REGEX_OR_NULL, REGEX_OR_NULL, REGEX_OR_NULL

    sql_expect  : "PERIODIC_DATA_REKEYING", "true", ".*", ".*", ".*", ".*"

  </custom_item>

</check_type>

The 'sql_request' tag contains SQL statements executed through the Snowflake REST API endpoint. The 'sql_expect' tag will evaluate the data for a passing or failing result.

Target Release Date

Immediate