Make no mistake, this CIO is a fan of Snowflake and all the power the data and AI cloud platform brings. However, perplexingly and bizarrely Snowflake dragged its feet when it came to MFA. Yes, MFA was possible, but implemented in a terrible way such that users had to set themselves up on it. All a beleagured Snowflake admin could do was ask and ask and remind people over and over again to do it.

MFA was not automatically enabled on a Snowflake account, and nor could the administrator force it to be on for any specific user. Instead, users were required to self-enrol into MFA following the instructions here. Administrators can disable MFA if a user loses a device, but the responsibility to turn it on in the first place sat squarely with the user.

This was not good policy. iTWire has regularly insisted company's must be using MFA as the most minimum, the most basic, of protections because it was never a question of "if" users would be breached via credential theft, but "when." We spoke with Geoff Schomburgk of Yubico here about how enterprises can lead the way by issuing FIDO2 hardware keys to users (such as Yubico's own popular range of Yubikeys, as well as other providers such as FEITIAN). We spoke with Alex Tilley of Secureworks here about the basics of security that everyone needs to do - like MFA. And, Rapid7 research showed a staggering 41% of security incidents in 2023 could have been prevented if only MFA were in place.

Believe me, the messaging from iTWire cannot be more consistent and relentless - if you don't have MFA turned on, then you need to.

And there sure are some Snowflake customers who wish they had MFA on.

It began with the massive Ticketmaster data breach, which in turn affected Australians via Ticketek, whereby some 560 million customers had their personal data leaked because, you guessed it, Ticketmaster didn't have MFA turned on. And, that data was held in Snowflake. While an early, and since debunked, cybersecurity report wrongly claimed Snowflake had been breached, Snowflake were quick to point out they themselves were secure, but the customer - Ticketmaster - had its credentials stolen by a malicious party, which led to the breach. And, Snowflake said, the customer didn't have MFA enabled, and really should have.

Yet, more and more news came out of other compromised Snowflake customers, and while Snowflake itself most definitely had not been breached - it's not like it holds a master record of customer login details anyway, with its product spread out over major clouds and regions - it seemed sophisticated hackers had targeted Snowflake customers. And, the reality is, as much as Snowflake can say it provided MFA, and customers should be using it, the company truly did not help itself with its poorly-implemented, poorly-considered MFA policy of the past.

As a former Snowflake administrator myself, I can only lament the frustration of asking all my ACCOUNTADMINs and other users to please, please execute this command to enroll yourself into MFA. I had no power to turn it on for anyone but myself; I had no power to make it mandatory for new accounts.

Happily, and thankfully, that changes now. The new Snowflake feature allows admins - finally, hoorah, and not a nanosecond too soon - to enforce MFA.

This is enabled via an AUTHENTICATION POLICY object, to force users to enroll in MFA on login. It can be set account-wide, or on a per-user basis. But seriously, do it account-wide.

iTWire's advice is that a well-rounded authentication policy should include (at a minimum):

• Any user accounts used by people should use SSO or MFA

• Service accounts should use keypair authentication or OAuth

• A break-glass admin account should be set up with a very strong password

You should also ensure this policy is part of any infrastructure-as-code that you have. It's supported already by Titan Core, and you should check your other IaC tooling.

Further, Snowflake admins can monitor compliance, as well as identify other issues, with the new Snowflake trust centre.

What will you do after reading this announcement?

• If you are a Snowflake customer, you should set up the authentication policy now. Right now.
• If you have other accounts on any other system anywhere that does not have MFA enabled, do it. Right now.
• If you are a software provider that's been dragging the chain on MFA then, far out, make it available to your customers. Right now. Otherwise you'll be sure to be on the front page of iTWire next, and not for good reasons.

This iTWire writer and CIO never takes delight in browbeating any company but let's learn from Snowflake here. Security is too important to be left to chance, to be left to end users being relied on to always do the right thing.

I'm grateful and glad Snowflake has now given admins the tools to enforce MFA across their organisation. I only wish it hadn't taken front-page news of weakness, and multi-company exploitation, to force it to happen.