4 ms·
Many here think that I'm afraid of my companies data being used to train models, but that is only half-correct. The value proposition of Azure OpenAI to the en
by ajcp 3y ago
Many here think that I'm afraid of my companies data being used to train models, but that is only half-correct.
The value proposition of Azure OpenAI to the enterprise is that it's bound by the Enterprise Agreement for not just data-use, but data access writ-large. I don't want my data to be accessible for *any reason* by a vendor that isn't covered explicitly in the EA.
While OpenAI says they delete your data after 30-days I have no contract or agreement in place that ensures that, or that within those 30-days they don't have carte blanche to my data for whatever else they may want to do with it.
The Azure OpenAI agreement *explicitly* states they only store my data for 30-days and can *only* access it if they suspect abuse of the service according to the ToC and our EA, which is no different than for other Azure services on my tenant. IIRC that's only after notifying me as well, and cannot exfiltrate that data even if they access it.
- gigel82 3y agoI suspect a lot of folks never worked with Enterprise / Gov customers and don't understand the restrictions and compliance requirements (like data residence, access control, FedRAMP, TISAX, reliability SLAs, etc. which you get with Azure but not with some "move fast and break things" startup like OpenAI). My comment is not dissing on the author, I'm just pointing out what most folks get from Azure is compliance (and maybe safety), and an OSS cannot solve that (unless they're running some other models in owned infrastructure or on-prem).
- quickthrower2 3y agoEven just doing SOC2 we prefer it Let alone if you are a SaaS your customers may demand it.
- robertlagrant 3y ago> most folks get from Azure is compliance To be fair, this doesn't prevent problems. Paperwork doesn't plug any security gaps in any cloud provider.
- toomuchtodo 3y agoIt potentially plugs the contractual and liability risks, which might be more important (talk to your legal and compliance folks). None of your data is going to launch nuclear missiles, if it leaks it would be unfortunate, but not as much as the litigation and regulatory costs you could potentially incur. Everyone gets popped eventually. It's your job to show you operated from a commercially reasonable security posture (and potentially your third party dependency graph, depending on regulatory and cyber insurance requirements). (i report to a CISO, and we report to a board, thoughts and opinions are my own)
- robertlagrant 3y agoI'm not disagreeing, but I'm making a separate point. I'm familiar with CYA, and need to use it myself, but that doesn't affect my previous point.
- cebert 3y ago> (i report to a CISO, and we report to a board, thoughts and opinions are my own) That sounds like an interesting role. How did you get there? Did you start as a security analyst and work your way up?
- toomuchtodo 3y agoWord of mouth referral into the org, last ~5 years as a security architect/cybersecurity subject matter expert, before that DevOps/infra engineer. 20+ years in tech. I rely solely on network and reputation. Be interesting to people who can provide you opportunity, and ask whenever an opportunity presents itself. If you don’t ask, the answer is default no. Being genuinely curious and desiring to help doesn't hurt either.
- ralph84 3y agoCompliance isn’t about preventing problems. It’s about identifying risks and determining who is responsible for mitigating those risks and who is on the hook for damages if the risks aren’t sufficiently mitigated.
- ajcp 3y agoYup, and I agree with you. Even beyond enterprise thought people seem to think that the only thing their data is good for as far as OpenAI is concerned is for training-datasets, but that's just not the case. The authors of this have built something great, but it doesn't protect you from any of those non-training use-cases.