Boosting Cybersecurity: Snowflake Rolls Out Mandatory MFA to Safeguard Data

3 min readOct 22, 2024

In an era where data security is paramount, Snowflake has taken a significant step to enhance its platform’s security features. The latest update introduces mandatory Multi-Factor Authentication (MFA) for Snowflake accounts, empowering administrators to enforce compliance and protect sensitive data. Below are the key highlights of this announcement.

1. Mandatory MFA for All Users

Snowflake admins can now enforce MFA for all users, ensuring an extra layer of security for account access. This feature allows for customization, enabling administrators to require MFA specifically for local users or include Single Sign-On (SSO) users as well.

2. User Prompting for MFA Setup

To encourage MFA adoption, users who still need to enable MFA will receive prompts upon logging into Snowsight. If MFA needs to be configured, users will be reminded to set it up every three days, helping to drive compliance within the organization.

3. Custom Authentication Policies

Snowflake allows administrators to create tailored authentication policies to specify whether MFA is required or optional for different users. For example, the following SQL code illustrates how to require MFA for local users:

CREATE AUTHENTICATION POLICY mfa_enforcement_policy
MFA_ENROLLMENT = 'REQUIRED'
MFA_AUTHENTICATION_METHODS = ('PASSWORD');

ALTER ACCOUNT SET AUTHENTICATION POLICY mfa_enforcement_policy;

ALTER USER <satish> SET AUTHENTICATION POLICY mfa_enforcement_policy;

Additionally, service users can be excluded from MFA requirements, allowing for more flexible management of user access.

CREATE AUTHENTICATION POLICY mfa_override_policy
MFA_ENROLLMENT = 'OPTIONAL'
MFA_AUTHENTICATION_METHODS = ('PASSWORD');

ALTER USER <sf_service_user> SET AUTHENTICATION POLICY mfa_enforcement_policy;

4. Trust Center for Monitoring Compliance

The newly enhanced Trust Center offers administrators a comprehensive view of their security posture. It includes tools such as the Security Essentials scanner package, which helps identify credential theft risks and monitors MFA compliance. This package is enabled by default and is available free of charge across all Snowflake editions.

5. Best Practices for Implementation

With the introduction of these new features, Snowflake encourages organizations to follow best practices to bolster their security:

- Identify and Transition Service Users: Move service users from password authentication to OAuth or key-pair authentication.
- Set Strong Password Policies: Establish account-level authentication policies requiring MFA and set robust password parameters.
- Monitor Security Compliance: Utilize the Trust Center to keep track of MFA usage and ensure network policy configurations are in place.

6. What’s Next?

Snowflake is committed to continuously enhancing its security measures. MFA will be required for all human users in newly created Snowflake accounts. Current users are urged to implement MFA authentication policies and leverage the Trust Center to prepare their environments for upcoming features.

Conclusion

The recent enhancements to Snowflake’s security framework underline the company’s dedication to protecting user accounts and sensitive data. By enforcing MFA, providing custom authentication policies, and leveraging the Trust Center for compliance monitoring, Snowflake is taking proactive steps to safeguard its users in an increasingly complex digital landscape.

For more information on Snowflake’s security features and best practices, visit [Snowflake’s Security Hub](https://www.snowflake.com/security/).