Cognitive Services and AI Security

Azure Cognitive Services are cloud-based APIs that enable AI capabilities such as vision, speech, language, and decision-making. They are offered as managed services, meaning Microsoft handles the underlying infrastructure, model training, and scaling. From a security perspective, these services present unique challenges because they process potentially sensitive data (e.g., user images, text, audio) and are accessed over the internet. The AZ-500 exam tests your ability to secure these services using Azure's built-in security controls.

Cognitive Services support two authentication methods: subscription keys and Azure Active Directory (Azure AD) tokens. Subscription keys are static strings generated when you create the service resource. They are passed in the HTTP header Ocp-Apim-Subscription-Key. Azure AD authentication uses managed identities or service principals to obtain an OAuth 2.0 token, which is passed in the Authorization header as Bearer <token>.

Key Points for the Exam: - Subscription keys are simpler but less secure because they are long-lived and can be leaked. They are considered a shared secret. - Azure AD authentication is recommended for production because it supports role-based access control (RBAC), conditional access, and token expiration. - You can disable key-based authentication by setting the disableLocalAuth property to true on the Cognitive Services account. This forces all requests to use Azure AD. - To use Azure AD, the caller must have the Cognitive Services User role (or a custom role with Microsoft.CognitiveServices/accounts/read and Microsoft.CognitiveServices/accounts/listKeys/action permissions).

By default, Cognitive Services endpoints are publicly accessible over the internet. To restrict access, you can use Azure Private Link (private endpoints) or virtual network service endpoints. Private endpoints assign a private IP address from your virtual network to the Cognitive Services account, making it accessible only from within that VNet or peered networks. Service endpoints extend your VNet identity to the service over the Azure backbone, but the service still has a public endpoint.

Comparison for the Exam: - Private endpoints are more secure because the traffic never leaves the Microsoft network and the service is not exposed to the internet. They also support network security groups (NSGs) and route tables. - Service endpoints are simpler but the service remains reachable from the internet if the firewall is misconfigured. They do not allow the service to be fully isolated. - You can also configure IP firewall rules to allow only specific public IP ranges.

All Cognitive Services data is encrypted at rest using Azure Storage Service Encryption (SSE) with Microsoft-managed keys by default. You can optionally use customer-managed keys (CMK) stored in Azure Key Vault. For data in transit, HTTPS is enforced (TLS 1.2 minimum). The exam may ask about compliance requirements such as HIPAA or FedRAMP, where CMK is often required.

CMK Configuration Steps: 1. Create an Azure Key Vault and generate or import a key. 2. Enable soft delete and purge protection on the Key Vault. 3. Assign the Cognitive Services account a system-assigned managed identity. 4. Grant the managed identity Get, Unwrap Key, and Wrap Key permissions on the key. 5. Update the Cognitive Services account to use the customer-managed key.

Cognitive Services integrate with Azure Monitor and Azure Activity Log. You can log API calls, authentication failures, and quota usage. Diagnostic settings can stream logs to Log Analytics, Storage, or Event Hubs. The exam may ask about enabling diagnostic logs for security analysis.

Key Metrics: - TotalCalls: Total number of API calls. - TotalErrors: Number of calls that resulted in HTTP 4xx or 5xx errors. - BlockedCalls: Calls blocked due to rate limiting or IP restrictions.

Cognitive Services often need to access other resources like Storage Accounts or Key Vault. Using managed identities eliminates the need for credentials in code. For example, a Cognitive Services account can use its system-assigned managed identity to read images from a Storage Account for processing. The exam tests that you understand how to assign the managed identity and grant it the necessary RBAC role (e.g., Storage Blob Data Reader).

Azure Cognitive Services include content moderation APIs that can detect offensive or inappropriate content. Security teams can use these to enforce acceptable use policies. The exam may cover how to configure content moderation filters and review tools.

Using Azure CLI, you can manage Cognitive Services security settings. Example commands:

Disable local authentication (keys):

az cognitiveservices account update --name myAIService --resource-group myRG --disable-local-auth

Enable private endpoint:

az network private-endpoint create --name myPE --resource-group myRG --vnet-name myVNet --subnet mySubnet --private-connection-resource-id /subscriptions/.../providers/Microsoft.CognitiveServices/accounts/myAIService --group-id account

Set IP firewall rules:

az cognitiveservices account network-rule add --name myAIService --resource-group myRG --ip-address 203.0.113.0/24

Enable customer-managed key:

az cognitiveservices account update --name myAIService --resource-group myRG --cmk-key-vault https://myvault.vault.azure.net/keys/mykey --cmk-key-name mykey

Cognitive Services security is closely tied to: - Azure Key Vault: For storing customer-managed keys and secrets. - Azure Private Link: For network isolation. - Azure AD: For authentication and authorization. - Azure Policy: To enforce security configurations (e.g., require private endpoints). - Azure Monitor: For logging and alerting.

Enterprise Scenario 1: Healthcare Compliance with HIPAA

A hospital uses Azure Cognitive Services for medical image analysis (e.g., detecting tumors in X-rays). The solution must comply with HIPAA, which requires encryption of protected health information (PHI) at rest and in transit, and strict access controls. The security team configures the Cognitive Services account with customer-managed keys stored in Azure Key Vault with soft delete and purge protection. They disable local authentication and use Azure AD authentication with managed identities for the application. Network access is restricted using a private endpoint in a VNet that is peered with the hospital's on-premises network via ExpressRoute. All API calls are logged to a Log Analytics workspace, and alerts are set for any access from unexpected IPs. They also enable content moderation to ensure no offensive content is processed. A common mistake is forgetting to disable key-based authentication, which would leave a backdoor if a key is leaked. The team regularly rotates keys and reviews access logs.

Enterprise Scenario 2: Retail Chatbot with Conditional Access

A retail company deploys a chatbot using Azure Cognitive Services Language Understanding (LUIS) and QnA Maker. The chatbot is accessed by customers and employees. For employees, they want to enforce multi-factor authentication (MFA) and conditional access policies. They configure the Cognitive Services account to use Azure AD authentication and assign the Cognitive Services User role to the employee app's managed identity. A conditional access policy is created that requires MFA for all access to the Cognitive Services endpoint. For customer access, they continue using subscription keys but rotate them frequently. They also implement IP firewall rules to allow only the chatbot's backend IP. Performance considerations: The chatbot handles up to 1000 requests per minute, so they choose the S0 pricing tier (1000 calls per minute). They monitor TotalCalls and TotalErrors to ensure they don't hit rate limits.

Scenario 3: Financial Services with Azure Policy

A bank uses Cognitive Services for fraud detection. They have a strict policy that all Cognitive Services accounts must have private endpoints and CMK enabled. They enforce this using Azure Policy with built-in policies like 'Cognitive Services accounts should use customer-managed keys for encryption' and 'Cognitive Services accounts should use private link'. Any new account that violates these policies is automatically denied or flagged. They also use Azure Blueprints to standardize the deployment. A common issue is that developers forget to assign the managed identity to the Cognitive Services account when setting up CMK, causing the encryption to fail. The policy alerts them to this misconfiguration.