Microsoft AI Data Exposure: 5 Things To Know

A Microsoft employee’s accidental exposure of company data has sparked a conversation over the security of Shared Access Signature tokens.

SAS tokens allow users to provide select access to specified Azure Storage resources, according to Microsoft.

However, an employee’s sharing of a uniform resource locator for a blog store in a public code repository while working on open-source learning models for artificial intelligence accidentally exposed 38 terabytes of private data, according to security vendor Wiz, whose researchers discovered the exposure.

[RELATED: Microsoft AI Research Team ‘Accidentally’ Exposes 38 Terabytes Of Private Data: Wiz] 

Microsoft SAS Token Exposure

No customer data was exposed and no other internal services were at risk, according to Microsoft.

David Stinner, founder and president of US itek, a Buffalo, N.Y.-based MSP and Microsoft partner, told CRN that the incident is a reminder “that those of us in IT security only need to be wrong once, while the bad actors only have to be right once.”

Tim Bates, Lenovo’s CTO for the global accounts business, said on Microsoft-owned LinkedIn that “this incident underscores the challenges of securing massive amounts of data, especially in the fast-paced world of AI development.”

“It’s a wake-up call for companies to tighten their security protocols,” Bates said.

New York-based Wiz warned that SAS tokens should be considered as sensitive as account keys and recommends not using account SAS tokens for external sharing. Instead, users should consider SAS with stored access policy and user delegation SAS.

“Token creation mistakes can easily go unnoticed and expose sensitive data,” Wiz said in its report on the exposure.

Wiz also commented on the risks posed as more organizations explore AI—organizations need to watch out for oversharing data and watch out for a supply chain attack within repository models.

Here’s what else you need to know about the exposure.