Security review: finding a time

Hello Euan, Thank you for taking the time on our last call. As promised, I'd like to get the security review for the Enterprise tier into the diary so that your findings have somewhere to live before anything else moves. To be precise about what I'm proposing: a working session of about an hour, with me walking through the architecture and you steering. BB-Demo runs inside the customer's own Snowflake account, so the most useful starting point is probably who has access to what in that account, and what BB-Demo staff can and cannot see. I'll put the answers in writing afterwards rather than leaving them as things said on a call. Could you do Tuesday or Wednesday next week? Mornings are easiest for me, but I can move around whatever suits you and your team. It would also help to know which questions you want covered first, and whether anyone else from your risk side should be on the invitation. If you have a questionnaire or a list of open findings, please send it ahead and I'll answer against it directly. Thanks, Hannah Hannah Lowe Solutions Engineer, BB-Demo

Hannah, Thank you. Wednesday afternoon works for me, after lunch if possible. I would rather keep it to the one session, but I will tell you now that I expect it to overrun, as there are a number of points I cannot close from the material received so far. So that the time is used well, here is what I would like covered, in this order: First, where the data is stored, in which region, and who can see it. Please evidence that, rather than describe the intent. Second, who has standing access to the Snowflake account, to the connectors and to any support tooling. I am asking about standing access, not access granted on request. Third, what the incident history is. I would like to know what has happened, how it was detected and how it was reported to customers. Fourth, how credentials for each connected source are held and rotated. Fifth, how deletion works if we were to leave, and what evidence you can give that it has happened. I have not closed any of my existing findings, and I will not be doing so on the strength of a reference or a statement that a control exists. If a document or a screenshot is available for each point, please send it before the session. My risk committee will want to see the same thing. I will bring one colleague from our risk team. Euan Rattray

Euan, That's helpful, and the numbered list is exactly what I wanted. Wednesday afternoon is fine, and I'll send an invitation shortly for 14:00 with enough room after it that we can overrun without anyone watching the clock. The short answer is that I can evidence the first two and the fourth from our own documentation. The longer answer is that on incident history and on deletion I want to check the wording with our head of security before I put anything in writing, because I would rather give you a precise answer a day late than an approximate one today. I won't tell you a control exists unless I can show it to you. I'll send the architecture diagram and the access model ahead of Wednesday so you and your colleague can read them first, and I'll mark clearly which items are documented and which are still being confirmed. Thanks, Hannah