Proactive Steps for Securing MLOps Projects // Chris Van Pelt // MLOps Podcast #192 clip

Key Takeaways

so my name is Chris Van Pelt I am co-founder and chief information security officer at weights and biases um I like my coffee as a good old French Press maybe with oh look I've got my little Emoji too um french press a little oat milk lately has been more my jam uh sometimes half and half but yeah just a a good french press but it's like good beans you know like the fancy hipster coffee shop for sure what are some things that you can give us as advice as like easy wins to make sure that hey if we are bringing on new tooling we've got our checks and balances and we're good on that and then be just like in general how can we assure success I think first like start thinking about it from the beginning like even when you are a small start up working on something there are you know a few things that will go a long way in ensuring you're going to be able to develop software securely so one is like leas privilege which is it's such It's Tricky um but it's it's really important so like the easiest thing when you're like giving new Engineers uh access to say your AWS account is give them like some permissions that let them do basically like everything that is bad you want to you know limit the permissions of what anyone on the team can do and hopefully get that into terraform and make it really easy to maybe give people temporary uh escalations and then bring them down uh the other pieces are just using good security tooling so uh set up scanning of any Docker containers that being built for for cves if you ever deliver these to Enterprise customers they're going to find them before you do if you aren't doing that which is embarrassing uh and it should be easy to just update uh the dependencies there and have you know a vulnerability kind of management system like dependabot on GitHub will tell you I think it's especially gnarly in the JavaScript ecosystem there's just so many dependencies and so many cves out there but but staying on top of that um is important because the your customers can see it and their teams are going to be concerned about these things yeah uh what else yeah um I mean keep track of vendors like from the beginning when you decide to like use some thirdparty service first step back and say okay what data are we giving them and what classification does it fall into so you can think of like highly confidential um kind of secret but not um terribly confidential and then just low risk and for anything High you should be like confident that they are a mature vendor that has like a sock 2 um type two at the station or some accreditation because eventually you're going to have to tell your customers who your subprocessors are um and they're going to uh you know be pretty concerned if you're using this other you know brand new startup um that maybe won't have those [Music] accreditations [Music]