Inflection Point | Lessons from the Snowflake Data Breach

NOTE: I wrote the following template for you to modify and send to your senior decision-makers.

?????? START TEMPLATE ??????

Subject: Urgent Security Update: Lessons from the Snowflake Data Breach

Dear [Decision Maker],

I’m reaching out to discuss the recent Snowflake data breach, which has the potential to be one of the largest in history. As more details emerge, it’s clear that this incident has far-reaching implications for companies across various industries. I believe it’s crucial for us to understand what happened and take proactive steps to protect our organization.

Key Points about the Breach:

1.??? Attackers gained access to Snowflake customer accounts using stolen login credentials, likely from info-stealing malware.

2.??? The breach has impacted numerous Snowflake clients, including high-profile companies like Ticketmaster, which had millions of user records compromised.

3.??? Cybercriminal groups are actively selling massive amounts of stolen data on underground forums, with some datasets containing hundreds of millions of records.

4.??? Investigations by cybersecurity firms CrowdStrike and Mandiant suggest the breach was not due to vulnerabilities in Snowflake’s platform, but rather the result of attackers using credentials stolen from other sources.

Lessons Learned:

1.??? Multi-Factor Authentication (MFA) is no longer optional. Accounts protected by only a username and password are at high risk of compromise. We must implement MFA across all critical systems and user accounts.

2.??? Password reuse is a major vulnerability. Attackers often use credentials stolen from one breach to gain access to other accounts where the same password is used. We need to educate our workforce about the importance of using unique, strong passwords for each accounts, which is only practice when using a robust password manager.

3.??? Regular security assessments are essential. As cyber risks evolve, we must continually assess and update our cyber hygiene practices to make sure they remain effective against current threats.

4.??? Cybersecurity is everyone’s responsibility. From executives to entry-level employees, everyone plays a role in protecting our organization’s data.

Next Steps:

1.??? I recommend we conduct an immediate review of our authentication practices and implement MFA for all user accounts, prioritizing those with access to sensitive data.

2.??? We should also consider deploying a password management solution to help employees generate and securely store unique passwords for each account.

3.??? I suggest we schedule a meeting with our IT and security teams to discuss the implications of this breach and identify any additional steps we can take to strengthen our defenses.

4.??? Finally, we need to give everyone role-appropriate cybersecurity duties and then give them the tool and training they need to succeed.

The Snowflake breach is a clear reminder that cyber is a dynamic risk that requires us to constantly improve so we don’t become an easy target for exploitation. By learning from this incident and taking proactive steps to enhance our security posture, we can better protect our company, our customers, and our reputation.

I appreciate your attention to this critical matter and look forward to working together to ensure the security and resilience of our organization.

Best regards,

[Your Name] [Your Title]

?????? END TEMPLATE ??????

Are you going to use this template to start a productive conversation with your senior decision makers?

Hit comment and let me know.

I read every comment you post.

-Kip

P.S. Please share this "Inflection Point" with someone you care about.

Subscribe here!

Current Podcast Episode: “FTC 2023 Privacy and Data Security Update”

What kinds of unfair trade practices does the FTC look for when it comes to privacy and data security? Let’s find out with your hosts Kip Boyle, CISO with Cyber Risk Opportunities, and Jake Bernstein, Partner with K&L Gates.

Want to know how to quickly make your company a smaller target for cyber-attackers?

By the way...

I’ve been invited back to the Philippines to teach in-person.

This will be another “train the trainer” course on basic cybersecurity.

My students will primarily be university professors who want to create and deliver this education to their students.

As a person who approaches his work with a teacher’s heart, this is some of the most rewarding work I’ve done.

The only thing that might top it was the cybersecurity training I gave not long ago to civil rights activists working in a country where they were being tracked by an oppressive government.

They were risking their lives and I helped them know how to stay safe while using the Internet and in-country mobile communication.

Wow. What a privilege for me.

Kip Boyle is a husband, dad, entrepreneur, and experienced cyber risk manager. He founded Cyber Risk Opportunities LLC in 2015, after seven years as the CISO of PEMCO Insurance in Seattle. As a captain on active duty in the US Air Force, he served in the Combat Archer and F-22 Stealth Fighter programs where he was the director of enterprise network security. These days, he serves as virtual chief information security officer for many customers, including a professional sports team and fast-growing FinTech and AdTech companies. Over the years, Kip has built teams by interviewing hundreds of cybersecurity professionals. And now, he’s sharing his insider’s perspective with you!

Connect with Kip on LinkedIn

Visit Cyber Risk Opportunities

Download Kip's Book

Don't ever miss the opportunity for cyber resilience! Click subscribe to see our monthly newsletter in your inbox for your competitive business advantage.

Cyber Risk Opportunities LLC

113 Cherry St #92768, Seattle, WA 98104-2205