In Part 1 and Part 2 of this blog post series, Snowflake Service Account Security, discussed service accounts threats and how to mitigate those threats with Snowflake features. Part 3 demonstrates how to manage credential rotation with a sample Hashicorp Vault plugin. You can use many platforms to achieve similar results. The important thing is to understand the patterns used to apply these controls to protect your service accounts.

The COVID-19 pandemic is forcing every business to see the world differently. From examining business continuity plans, modernizing workforce plans, or building supply chain resiliency, no facet of business has gone untouched. As organizations combat the economic fallout now and in the coming years, agility has never been more important. The key to remaining agile is a better use of data.

The benefits of building a DevOps culture for software companies are clear. DevOps practices integrate once-siloed teams across the software development lifecycle, from Dev to QA to Ops, resulting in both faster innovation and improved product quality. As a result, most software development teams have deployed tools to enable DevOps practices across their workflow.

As first-party customer data continues to explode, companies have struggled to make it actionable for personalization, advanced analytics, and other business purposes. As a result, customer data platforms that consolidate and activate known customer information have emerged to help companies generate ROI from their data. At present, nearly 80% of marketing organizations already have a customer data platform or are developing one.

One thing nearly all such data providers have is a REST API. Snowflake’s recently announced external functions capability allows Snowflake accounts to call external APIs. By using external functions, data enrichment providers can fulfill requests for data from Snowflake Data Marketplace consumers.

Many data providers who participate in Snowflake Data Marketplace are already using Snowflake Cloud Data Platform as their primary data store, and they can share secure slices of their data via Global Snowflake, Snowflake’s global data sharing feature, with any other Snowflake consumer regardless of which cloud or Snowflake region each is using. But other potential data providers, especially data enrichment companies, are not yet using Snowflake themselves.

Fast-growing software companies are building data applications for a variety of uses, from marketing apps that provide customer insights, to IoT apps that handle device feedback, and data analytics apps that process both historical and near real-time data. But developers often face obstacles when building, designing, and supporting applications that need to parse large volumes of information.

Even in a global economy, businesses need a deep understanding of local markets. For example, marketing campaigns designed to attract buyers in a large metropolitan area won’t necessarily attract small-town customers. Noticing that buying patterns in one area are extending into a larger regional or nationwide trend can lead to decisions that increase profits. But accessing and analyzing a broad spectrum of geospatial data has been difficult and expensive. That is changing.

Snowflake customer, Merkle Inc., has created a new set of COVID-19 interactive dashboards for businesses to use for free to determine which counties in the U.S. will most likely experience an economic recovery first. As economies reopen, states hit hardest by COVID-19, or states that relax social distancing measures sooner rather than later, will not reveal local market opportunities as they emerge.

In Part 1, we covered the high-level objectives and methods for attacking service accounts. In Part 2 we discuss defense-in-depth mitigations to those methods. By the end of this blog, you will be able to apply secure-by-default mitigations to threats impacting Snowflake service accounts. The following table from Part 1 highlights the objectives and methods we want to mitigate: These secure-by-default mitigations help prevent and constrain credential misuse from theft and guessing attacks.