{"id":10077,"date":"2024-05-13T09:00:21","date_gmt":"2024-05-13T16:00:21","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=10077"},"modified":"2024-05-29T08:14:11","modified_gmt":"2024-05-29T15:14:11","slug":"how-to-implement-commercial-data-protection-for-copilot-using-infoblox-dns","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/how-to-implement-commercial-data-protection-for-copilot-using-infoblox-dns\/","title":{"rendered":"How to Implement Commercial Data Protection for Copilot using Infoblox DNS"},"content":{"rendered":"

As a commercial user of Microsoft\u2019s generative AI system, Copilot, you\u2019re likely aware of its incredible capabilities. However, with great power comes great responsibility, especially regarding data protection and privacy. In this blog post, I will explore the risks of using Copilot without proper Commercial Data Protection (CDP)<\/strong> and discuss how to address them.<\/p>\n

The Risks<\/h3>\n

Data Leakage and Privacy Concerns<\/strong>
\nSensitive information might be shared during conversations when interacting with Copilot. Without CDP, this data may not be adequately protected. Imagine accidentally leaking customer data, financial records, or trade secrets! Organizations must take steps to prevent data leakage and privacy breaches.<\/p>\n

Compliance Violations<\/strong>
\nVarious industries have strict compliance requirements, such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA). Failing to use CDP could result in legal penalties, fines, and damage to your organization\u2019s reputation.<\/p>\n

Intellectual Property Risks<\/strong>
\nCopilot generates code, documents, and other content based on user input. Without CDP, you may unintentionally expose your proprietary code, patented algorithms, or copyrighted material. Protecting intellectual property is crucial to maintaining a competitive advantage.<\/p>\n

Loss of Trust and Productivity<\/strong>
\nIf Copilot inadvertently shares sensitive information, users may lose trust in its reliability. Reduced trust can impact your organization’s productivity, collaboration, and overall efficiency.<\/p>\n

Reputation Damage<\/strong>
\nPublic perception matters. A data breach or privacy violation due to Copilot could harm your organization\u2019s reputation. Negative publicity may deter potential clients, partners, or investors.<\/p>\n

Enhancing Data Protection for Copilot Users: A Practical Guide<\/h3>\n

Enterprise customers should be sure to validate they are minimizing risks when using this tool, so let’s look at the recommended steps from Microsoft to enforce commercial data protection (CDP) and prevent accidental crosstalk to the public system.<\/p>\n

Enforcing Commercial Data Protection<\/strong><\/p>\n

Enable the \u2018Commercial Data Protection for Microsoft Copilot\u2019 Service Plan:<\/p>\n

    \n
  • Ensure that eligible users have activated this service plan.<\/li>\n
  • This step establishes the necessary boundaries for Copilot\u2019s operation within a commercial context.<\/li>\n<\/ul>\n

    Preventing Use without CDP<\/strong><\/p>\n

    To prevent users from accessing Copilot without CDP, Microsoft suggests you update your DNS configuration:<\/p>\n

      \n
    • For Copilot in Bing, Edge, and Windows, Update your DNS configuration by setting the DNS entry for www.bing.com<\/a> to be a CNAME for nochat.bing.com.<\/li>\n
    • For copilot.microsoft.com and the Copilot mobile app: Update your DNS configuration by setting the DNS entry for copilot.microsoft.com to be a CNAME for cdp.copilot.microsoft.com.<\/li>\n<\/ul>\n

      DNS configuration in Windows according to Microsoft:<\/strong><\/p>\n

      One small issue: You can\u2019t create CNAME records out of thin air, or simply drop them in other people\u2019s domains without impacting DNS for those domains! Microsoft currently recommends the following process for their customers:<\/p>\n

      Create DNS redirects for various Copilot entry points:<\/p>\n

        \n
      • For Active Directory Domain Services (AD DS): Deploy the DNS Role on a member server. On the newly deployed DNS server, create the following Forward Primary Zones:<\/li>\n
          \n
        • microsoft.com<\/li>\n
        • bing.com<\/li>\n<\/ul>\n
        • Create the following CNAME records in the respective zones:<\/li>\n
            \n
          • copilot.microsoft.com \u2014> cdp.copilot.microsoft.com<\/li>\n
          • www.bing.com<\/a> \u2014> nochat.bing.com<\/li>\n<\/ul>\n
          • On the AD DNS server, create the following Conditional Forwarders and make AD Integrated:<\/li>\n
              \n
            • Conditional forwarder for www.bing.com<\/a> pointing to the new DNS server<\/li>\n
            • Conditional forwarder for copilot.microsoft.com pointing to the new DNS server<\/li>\n<\/ul>\n<\/ul>\n

              That’s right – turn DNS on another system, and make it authoritative for microsoft.com and bing.com, so you can punch a \u2018hole\u2019 in their DNS! <\/p>\n

              Whew!<\/p>\n

              Better Techniques: DNS Firewall<\/h3>\n

              Enterprise network deployments using Copilot should also have some layer of DNS security deployed, it\u2019s important to remember that a proper \u2018DNS Firewall\u2019 means you can not only block\/allow, but also redirect DNS!<\/p>\n

              Let’s see what creating those redirects looks like under an Infoblox NIOS system running DNS:<\/p>\n

              DNS Firewall \/ Response Policy Zone – On-Prem:<\/p>\n

                \n
              • Build a redirect DNS Firewall Response Policy Zone for each target (e.g., bing.com, copilot.microsoft.com).<\/li>\n
              • Create domain redirect rules to match records and perform necessary redirects (the CNAME targets recommended by Microsoft).<\/li>\n
              • Deploy these rules to the forwarding layer DNS appliances.<\/li>\n<\/ul>\n

                \"figure<\/p>\n

                \"figure<\/p>\n

                If you have a cloud-based system for DNS Policy Enforcement, your instructions will be slightly different, but they will accomplish the same goal. <\/p>\n

                For Example: <\/p>\n

                Blox One Threat Defense in the Cloud<\/p>\n

                  \n
                1. Create custom redirect targets for both destinations nochat.bing.com and cdp.copilot.microsoft.com<\/li>\n

                  \"figure<\/p>\n

                2. Create custom lists for www.bing.com<\/a> and copilot.microsoft.com. These are used to match the query we want to redirect. <\/li>\n

                  \"figure<\/p>\n

                3. Add the custom lists to your security policies, and pick the correct redirect that you created in the first step.<\/li>\n

                  \"figure\n<\/ol>\n

                  By implementing these best practices, you\u2019ll enhance your security and help ensure responsible AI usage within your organization.<\/p>\n

                  Simplifying CDP Enforcement: Leveraging DNS Policy Engines<\/h3>\n

                  I think I\u2019ve shown the most straightforward approach to enforcing the Commercial Data Protection (CDP) policy involves utilizing a DNS policy enforcement engine. This can be achieved through response policy zones in systems like BIND and BIND-based setups. This is not an option in a purely Microsoft DNS environment, as it\u2019s policy feature lacks support for a redirect option upon matching.<\/p>\n

                  By leveraging non-Microsoft DNS, we can redirect traffic that might otherwise hit the public-facing side of Copilot toward the protected Copilot environment. This redirection ensures that Commercial Data Protection is enforced without risking accidental misconfigurations that could either leak internal information or inadvertently block all of Microsoft.com or Bing.com.<\/p>\n

                  Feel free to ask if you need further clarification or have additional questions! \ud83d\ude0a<\/p>\n

                  For Additional Information<\/h3>\n

                  Microsoft CDP Instructions
                  \n                  https:\/\/learn.microsoft.com\/en-us\/copilot\/manage#require-commercial-data-protection-in-<\/a><\/p>\n

                  Infoblox BloxOne Threat Defense
                  \n                  https:\/\/www.infoblox.com\/products\/bloxone-threat-defense\/<\/a><\/p>\n