About the Client
Supply Medium is a technology-focused organization specializing in cloud, data engineering, analytics, and enterprise data solutions. As the organization expanded its data platform and user base, protecting sensitive business information while enabling secure data access became a strategic priority.
Background
Supply Medium centralized its analytical and operational data within Snowflake to support reporting, business intelligence, and advanced analytics. As more departments—including Finance, Marketing, Compliance, Risk, Development, and Operations—required access to enterprise data, traditional role-based permissions alone were no longer sufficient to safeguard sensitive information.
The organization needed a modern security framework that could protect confidential data while allowing authorized users to access the information necessary for their roles.
Challenge
As enterprise data usage expanded, several security and governance challenges emerged:
- Increasing administrative effort required to maintain multiple access rules and custom database views.
- Need for fine-grained, column-level security based on user roles.
- Compliance requirements demanding robust data masking, governance, and audit capabilities.
- Risk of excessive user permissions leading to unintended exposure of sensitive information.
- Requirement for developers and QA teams to work with production-like datasets without exposing confidential data.
- Maintaining consistency across development, testing, and production environments.
Solution
Supply Medium partnered with our team to implement a scalable data security framework within Snowflake using Static and Dynamic Data Masking Policies.
Sensitive Data Discovery
- Leveraged Snowflake’s automatic data classification capabilities to identify and tag sensitive information such as:
- Personally Identifiable Information (PII)
- Email addresses
- Account numbers
- Dates of birth
- Financial identifiers
Persona-Based Access Design
Security policies were designed around business personas, ensuring users only viewed data appropriate to their responsibilities.
Examples included:
- Marketing Analysts
- Finance Teams
- Risk Analysts
- Compliance Officers
- Developers
- Business Intelligence Users
Static & Dynamic Data Masking
Static Data Masking
- Implemented within Development and QA environments.
- Sensitive information was permanently tokenized or anonymized before being made available to users.
Dynamic Data Masking
- Applied within Production environments using Snowflake Masking Policies.
- SQL-based masking rules evaluated user roles at query time and dynamically determined what information could be displayed.
Examples included:
- Social Security Numbers displayed as ––***.
- Account numbers partially masked.
- Email addresses hashed or obscured.
- Sensitive values hidden entirely for unauthorized users.
Automated Policy Deployment
- Bound masking policies directly to Snowflake security roles.
- Automated deployments across Development, QA, and Production environments through CI/CD pipelines.
- Leveraged Snowflake Access History and Query History for comprehensive auditing and governance.
Outcome
The Snowflake data security implementation delivered significant benefits for Supply Medium:
- Consistent masking policies enforced across all users and environments, significantly reducing the risk of sensitive data exposure.
- Automated policy management simplified regulatory audits and strengthened compliance with enterprise security standards.
- Developers gained secure access to production-like datasets while protecting confidential information, reducing environment provisioning time by approximately 30%.
- Centralized column-level security eliminated the need for manually maintained database views.
- Improved governance, secure self-service analytics, and increased user confidence in the enterprise data platform.
- Established a scalable security framework capable of supporting future business growth and expanding data access requirements.