The 34 Snowflake security checks Black Cat runs
Black Cat SSPM evaluates 34 security policies against your Snowflake configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Snowflake — what access Black Cat needs, and why.
Access control & privilege
11 checks · highest severity: high
Data sharing & exposure
6 checks · highest severity: high
Network security
4 checks · highest severity: high
Configuration hardening
10 checks · highest severity: medium
Access control & privilege (11)
- Password Only Auth severity: high
- Service Account Password Auth severity: high
- ACCOUNTADMIN Default Role severity: high
- Excessive Admin Roles severity: high
- No Separation Of Duties severity: high
- Disabled User With Active Grants severity: high
- Dormant User severity: medium
- User Not Disabled severity: medium
- ACCOUNTADMIN Excessive Grants severity: high
- Weak Password Policy severity: medium
- OAuth Integration Permissive severity: high
Data sharing & exposure (6)
- No Storage Integration Required severity: high
- Unload To Inline URL severity: high
- Unload To Internal Stages severity: medium
Network security (4)
- No Network Policy severity: high
- Network Policy Wildcard severity: high
- Network Policy No Blocklist severity: low
- Integration No Network Policy severity: high
Configuration hardening (10)
- Low Data Retention severity: medium
- SSO Login Page Disabled severity: medium
- No SSO Configured severity: medium
- No SCIM Configured severity: medium
- Warehouse No Auto Suspend severity: low
- Warehouse No Auto Resume severity: low
- Warehouse No Resource Monitor severity: low
- Warehouse Oversized severity: low
- No Account Resource Monitor severity: medium
- Resource Monitor Notify Only severity: low
Other checks (3)
severity: critical MFA Not Enabled fix difficulty: easy #
Enable MFA for the Snowflake user account
- Navigate to Snowsight at https://app.snowflake.com and sign in as ACCOUNTADMIN or USERADMIN
- Go to Admin > Users & Roles > Users and select the flagged user
- Click Edit and enable multi-factor authentication (MFA) enrollment for the user
- Alternatively, enforce MFA via an authentication policy — run: CREATE AUTHENTICATION POLICY require_mfa MFA_AUTHENTICATION_METHODS = ('TOTP') MFA_ENROLLMENT = REQUIRED;
- Attach the policy to the user: ALTER USER <username> SET AUTHENTICATION POLICY require_mfa;
- Verify the change: SHOW USERS LIKE '<username>';
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: critical Authentication Policy No MFA fix difficulty: easy #
Update the authentication policy to require MFA for all users
- Connect to Snowflake as ACCOUNTADMIN or SECURITYADMIN
- Identify the authentication policy: SHOW AUTHENTICATION POLICIES;
- Alter the policy to require MFA: ALTER AUTHENTICATION POLICY <policy_name> SET MFA_AUTHENTICATION_METHODS = ('TOTP') MFA_ENROLLMENT = REQUIRED;
- Verify the updated policy: DESCRIBE AUTHENTICATION POLICY <policy_name>;
- Ensure the policy is applied to the account or specific users/roles as intended
- Communicate the MFA requirement to affected users and provide enrollment instructions
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.3 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Data Rekeying Disabled fix difficulty: easy #
Enable periodic data rekeying to ensure encryption keys are regularly rotated
- Connect to Snowflake as ACCOUNTADMIN
- Enable periodic rekeying: ALTER ACCOUNT SET PERIODIC_DATA_REKEYING = TRUE;
- Verify the setting: SHOW PARAMETERS LIKE 'PERIODIC_DATA_REKEYING' IN ACCOUNT;
- Note that rekeying runs in the background and may take time depending on data volume
- For enhanced key management, consider Snowflake Tri-Secret Secure with a customer-managed key
- Review your encryption key rotation policy and document the rekeying schedule
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.ii GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7