10 ms·

its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on th

its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on the customer to secure your own environment.

smcin 2y ago
Snowflake is saying they knew of unusual activity "around mid-April 2024", confirmed "May 23, 2024", around which time they made MFA mandatory (although their customer AT&T say they knew of the breach "Mar 20"; these timelines keep shifting back): "Mandatory MFA option unveiled by Snowflake" - Jul 11, 2024 https://www.scmagazine.com/brief/mandatory-mfa-option-unveiled-by-snowflake https://www.scmagazine.com/brief/mandatory-mfa-option-unveil... > "US cloud storage firm Snowflake has already required the implementation of multi-factor authentication across all user accounts a month following the widespread breach of customer accounts, including those of Ticketmaster and Santander Bank, reports The Register."
- iaabtpbtpnn 2y ago
  It's not mandatory, I still have Snowflake user accounts that don't use MFA.
  - smcin 2y ago
    "Mandatory MFA option unveiled by Snowflake" sounds like they made it an option for an organization to decide to make MFA mandatory within that organization. But that conflicts with TheRegister headline - Snowflake's PR machine seems to be in overdrive.
mewpmewp2 2y ago
It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.
chefandy 2y ago
Right. Snowflake facilitated AT&T'S abject negligence, but ultimately the buck stops with AT&T, here.
deleted 2y ago
[deleted]
zer0c00ler 2y ago
[dead]
dghlsakjg 2y ago
Totally, way too many people are trying to blame snowflake. ATT is a technology infrastructure company. Secure transmission of data is one of their core business competencies (theoretically). They are a corporation that we trust to handle incredibly sensitive info. Call records are, in fact, incredibly sensitive data. They should be telling Snowflake what best practices to be using, not the other way around!
- yyyfb 2y ago
  AT&T and phone carriers in general are not technology companies. They are infrastructure companies that purchase off-the-shelf communication technology, slap a billing system on top, and then spend most of their time on operations (finding places to put towers, keeping the gear up and running) and marketing. The security component of communications isn't built by them, but by the equipment manufacturers that they purchase from. There are no strong penalties for involuntary data leaks - why would they do more?
  - dghlsakjg 2y ago
    ATT has a rich history of being a technology company. They invented UNIX! That's in the past, fair enough. So they used to develop cutting edge technology, they sell technology, they buy technology, they operate technology, they work with manufacturers to develop new technology, they operate the infrastructure underpinning the modern technology economy, but they aren't a technology company? Even if you want to argue that they aren't a technology company, they sure spend enough time doing everything a technology company does to hold them accountable for their technology failures.
    - dahart 2y ago
      > They invented UNIX! They also invented the transistor, C, the photovoltaic cell, radio astronomy, and … the telephone. ;) Yes that’s the past, but AT&T labs still employs almost two thousand people. It’s very funny to try to claim AT&T isn’t a technology company and only peddles services on top of equipment made by others.
    - 2y ago
John23832 2y ago
I feel like this would be true if ONE customer was hacked. At this point it's more than a handful. AND snowflake knew about it. If all the lockboxes in a bank get broken into, is it respectable to say "ah all of the customers should have used better locks"? The bank is the party who is supposed to be giving the insight into secure storage. They're not just renting space.

smcin 2y ago

Snowflake is saying they knew of unusual activity "around mid-April 2024", confirmed "May 23, 2024", around which time they made MFA mandatory (although their customer AT&T say they knew of the breach "Mar 20"; these timelines keep shifting back): "Mandatory MFA option unveiled by Snowflake" - Jul 11, 2024 https://www.scmagazine.com/brief/mandatory-mfa-option-unveiled-by-snowflake https://www.scmagazine.com/brief/mandatory-mfa-option-unveil... > "US cloud storage firm Snowflake has already required the implementation of multi-factor authentication across all user accounts a month following the widespread breach of customer accounts, including those of Ticketmaster and Santander Bank, reports The Register."

iaabtpbtpnn 2y ago
It's not mandatory, I still have Snowflake user accounts that don't use MFA.
- smcin 2y ago
  "Mandatory MFA option unveiled by Snowflake" sounds like they made it an option for an organization to decide to make MFA mandatory within that organization. But that conflicts with TheRegister headline - Snowflake's PR machine seems to be in overdrive.

mewpmewp2 2y ago

It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.

chefandy 2y ago

Right. Snowflake facilitated AT&T'S abject negligence, but ultimately the buck stops with AT&T, here.

deleted 2y ago

[deleted]

zer0c00ler 2y ago

[dead]

dghlsakjg 2y ago

Totally, way too many people are trying to blame snowflake. ATT is a technology infrastructure company. Secure transmission of data is one of their core business competencies (theoretically). They are a corporation that we trust to handle incredibly sensitive info. Call records are, in fact, incredibly sensitive data. They should be telling Snowflake what best practices to be using, not the other way around!

yyyfb 2y ago
AT&T and phone carriers in general are not technology companies. They are infrastructure companies that purchase off-the-shelf communication technology, slap a billing system on top, and then spend most of their time on operations (finding places to put towers, keeping the gear up and running) and marketing. The security component of communications isn't built by them, but by the equipment manufacturers that they purchase from. There are no strong penalties for involuntary data leaks - why would they do more?
- dghlsakjg 2y ago
  ATT has a rich history of being a technology company. They invented UNIX! That's in the past, fair enough. So they used to develop cutting edge technology, they sell technology, they buy technology, they operate technology, they work with manufacturers to develop new technology, they operate the infrastructure underpinning the modern technology economy, but they aren't a technology company? Even if you want to argue that they aren't a technology company, they sure spend enough time doing everything a technology company does to hold them accountable for their technology failures.
  - dahart 2y ago
    > They invented UNIX! They also invented the transistor, C, the photovoltaic cell, radio astronomy, and … the telephone. ;) Yes that’s the past, but AT&T labs still employs almost two thousand people. It’s very funny to try to claim AT&T isn’t a technology company and only peddles services on top of equipment made by others.
  - 2y ago

John23832 2y ago

I feel like this would be true if ONE customer was hacked. At this point it's more than a handful. AND snowflake knew about it. If all the lockboxes in a bank get broken into, is it respectable to say "ah all of the customers should have used better locks"? The bank is the party who is supposed to be giving the insight into secure storage. They're not just renting space.