Securing Microsoft Azure OpenAI - Karl Ots

. .

Résumé :

Introduction xxiii

Chapter 1 Overview of Generative Artificial Intelligence Security 1

Common Use Cases for Generative AI in the Enterprise 1

Generative Artificial Intelligence 1

Generative AI Use Cases 2

LLM Terminology 3

Sample Three-Tier Application 4

Presentation Tier 5

Application Tier 5

Data Tier 5

Generative AI Application Risks 5

Hallucinations 6

Malicious Usage 6

Shadow AI 7

Unfavorable Business Decisions 8

Established Risks 8

Shared AI Responsibility Model 8

Shared Responsibility Model for the Cloud 9

Shared Responsibility Model for AI 10

AI Usage 10

AI Application 10

AI Platform 11

Applying the Shared Responsibility Model 11

Regulation and Control Frameworks 12

Regulation in the United States 12

Regulation in the European Union 12

NIST AI Risk Management Framework 14

Govern 15

Map 15

Measure 16

Manage 16

Key Takeaways 16

References 17

Chapter 2 Security Controls for Azure OpenAI Service 19

On the Importance of Selecting Appropriate Security Controls 19

Risk Appetite 20

Comparing OpenAI Hosting Models 21

OpenAI ChatGPT 21

Privacy and Compliance 21

Identity and Access Management 21

Data Protection and Encryption 22

Audit Logging 22

Network Isolation 22

Data Residency 22

Azure OpenAI 22

Privacy and Compliance 23

Identity and Access Management 23

Data Protection and Encryption 23

Audit Logging 23

Network Isolation 23

Data Residency 23

Recommendation for Enterprise Usage 24

Evaluating Security Controls with MCSB 24

Control Domains 26

Network Security 27

Identity Management 28

Privileged Access 28

Data Protection 29

Asset Management 29

Logging and Threat Detection 29

Incident Response 30

Posture and Vulnerability Management 30

Endpoint Security 31

Backup and Recovery 31

DevOps Security 32

Governance and Strategy 32

Security Baselines 33

Applying Microsoft Cloud Security Baseline to Azure OpenAI 33

Security Profile 34

How to Approach the Security Baseline 34

Data Protection 35

Identity Management 36

Logging and Threat Detection 37

Network Security 38

Asset Management 38

Backup and Recovery 39

Endpoint Security 40

Posture and Vulnerability Management 40

Privileged Access 41

Selected Controls 42

Mapping the Selected Controls to CIS and NIST 44

Using Azure Policy to Secure Azure OpenAI at Scale 46

Azure Policy 46

Continuous Compliance Monitoring 47

Azure Policies for Azure OpenAI 48

Key Takeaways 49

References 49

Chapter 3 Implementing Azure OpenAI Security Controls 51

OWASP Top 10 for LLM Applications 51

Prompt Injection 52

Insecure Output Handling 52

Training Data Poisoning 53

Model Denial of Service 53

Supply Chain Vulnerabilities 53

Sensitive Information Disclosure 54

Insecure Plugin Design 54

Excessive Agency 54

Overreliance 55

Model Theft 55

Access Control 56

Implementing Access Control for Azure OpenAI 56

Cognitive Services OpenAI User 57

Cognitive Services OpenAI Contributor 58

Azure AI Administrator 59

Azure AI Developer 61

Azure AI Enterprise Network Connection Approver 62

Azure AI Inference Deployment Operator 64

Preventing Local Authentication 65

Disabl...

Sommaire:

KARL OTS is Global Head of Cloud Security at EPAM Systems, an engineering and consulting firm. He leads a team of experts in delivering security and compliance solutions for cloud and AI deployments for Fortune 500 enterprises in a variety of industries. He has over 15 years' experience in tech and is a trusted advisor and thought leader. Karl is also a Microsoft Regional Director and Security MVP....