Setting a Security Baseline for Your Azure Machine Learning Workloads

In this chapter, we will summarize all the best practices outlined in this book for creating a security baseline for your machine learning workloads from start to finish to help you create a security strategy. We will mostly focus on Azure services, as we have in the rest of the book. Of course, there are always more things to consider, such as code or application security, but these are not the focus of this book.

We will review a couple of other services that, although not directly related to Azure Machine Learning, are useful to consider so that we can increase security in our Azure services overall. When it comes to security, we can use threat modeling to ensure that any practices we have identified and mitigated are continuously maintained and updated with any past and new security recommendations for as long as those services are up and running. Finally, we will review the cloud responsibility model so that...

Setting a baseline for Azure Machine Learning

Throughout this book, we have seen multiple services and explored several ways to secure the Azure Machine Learning workspace and its associated services in Azure. All those best practices are part of the suggested best practices. As we focus on securing our workloads, it’s essential to establish a security foundation to guide our efforts. A security baseline is a set of the minimum security controls we need to implement for a system. Let us again review what the minimum requirements are to protect workloads running in Azure Machine Learning, which we have already outlined previously in this book, and learn how to extend this functionality further by using other services.

Let us review the baseline Azure Machine Learning best practices organized by the Zero Trust model we reviewed in this book:

• Securing identity (Chapter 6):
  • Use Microsoft Entra ID best practices:
    • Enable multi-factor authentication (MFA) in user accounts
    • Use...

Threat modeling for Azure Machine Learning

Threat modeling is a structured methodology for detecting and ranking potential threats to a system and evaluating the impact that potential mitigations might have in decreasing or eliminating those threats. It is commonly used in the field of information security and cybersecurity, and we can apply this process to Azure Machine Learning as well to proactively protect our systems. What we are trying to determine when working with threat modeling are answers to the following questions:

• What are we working on?
• What can go wrong with the system?
• How are we going to deal with the issue?
• Is that enough? Did we miss anything else?

The process often follows these general steps, and it is an iterative process:

Figure 10.2 – The threat modeling process

Let us review each one:

1. Define objectives and review the architecture: Here, we need to clarify what we are trying to protect by...

Reviewing the shared responsibility model for cloud security

When it comes to migrating to the cloud, some of our responsibilities transfer to the cloud provider, such as the responsibility to purchase and maintain hardware. This concept is vital for understanding who is responsible for what when it comes to securing data, applications, and infrastructure in the cloud. The exact division of responsibilities can vary depending on the type of cloud service model being used, including infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS), and the specific cloud service provider.

The responsibility model according to Microsoft is as follows for each category of services:

Table 10.1 – Shared responsibility model

The same division of responsibilities applies to security. It’s essential to clearly understand the shared responsibility model with Azure and take the necessary steps to fulfill our part of...

Summary

Securing our resources is an iterative process. Although we may have completed all necessary steps to protect our resources, every update or new addition to our project might affect the overall security of the system. The first step is to maintain a security baseline for the resources we are using and the second is to develop a strategy to stay up to date using threat modeling frameworks to be proactive in mitigating possible threats. We saw the STRIDE methodology and the Microsoft Threat Modeling Tool, but there are more frameworks available. For example, we can base the strategy on the MITRE framework and tailor the steps for our organization.

Remember, security in the cloud is a shared responsibility. While Azure provides the tools and infrastructure to secure the cloud environment, it’s up to us to secure our configurations and data.

Cybersecurity has a multi-faceted nature and adversaries are becoming more creative every day. As our cloud ecosystem evolves...