Welcome to the MorphHats InfoSecure Blog
June 1, 2024Microsoft Recall and the New Class of AI Privacy Risk
June 14, 2024Through late May and into June 2024, a wave of data theft hit organizations using the Snowflake cloud data platform. The common thread was not a flaw in Snowflake itself. Attackers used credentials stolen earlier by infostealer malware to log into customer accounts protected by a password alone, with no multi-factor authentication enforced.
A familiar lesson, at cloud scale
Cloud data warehouses concentrate enormous volumes of sensitive information in one place. Where multi-factor authentication was missing and network restrictions were absent, a single reused or stolen password was enough to export large datasets. The provider secures the infrastructure, but you own identity, access policy, and configuration.
Practical hardening for cloud data platforms
- Enforce phishing-resistant MFA on every account, including service and admin logins.
- Restrict access by network policy so connections are only accepted from known ranges.
- Monitor for anomalous queries such as unusually large exports or logins from new geographies.
Takeaway: Treat every cloud data platform login as an internet-facing front door, enforce strong MFA everywhere, and constrain where connections can originate.