Forum Discussion
Security and control concerns
Hi,
My Head of IT has recently raised some concerns over security and control of our data that we use Power BI to report on, and I am worried this will give some business execs the jitters. Three concerns have been raised as follows:
- Data security - PowerBI queries databases and reports on them. The data security issues arise on how it does this, which is query in house databases, upload the data to the Microsoft Azure cloud, then generate reports from there. Not a huge problem at the moment as we tell it what data to query in each report, but Microsoft are changing the way they do this, so that at some point, PowerBI will upload ALL our data to the Azure cloud, then sift through it from there. A massive no-no as far as our governance stakeholders and clients are concerned.
- Control - as soon as the data leaves our network, we lose control of it and cede all data security and integrity to Microsoft. Again, a big business risk if looked at too deeply by clients who rely on us when we guarantee their data.
- Visibility - as soon as the data leaves our systems, we have no idea what is happening, what it is being used for or by who. We assume Microsoft who use it for storage and processing purposes, but we can't be sure. We also can't be sure, and have no control over where data is stored. GDPR rules and ICO regulations insist we store personally identifiable information in the UK or EU. We can't control this, and so are already technically in breach. Microsoft have been no strangers to being exploited by outside hackers and have already come to the attention of federal courts for training their AIs on customer data, so it is safe to assume our data is not 100% secure to us.
My question is this - How realistic are the above concerns? Has the head of IT read the situation correctly or jumped to some inaccurate conclusions?
I'd like to go back informally with some solid fact based information and hopefully calm the storm before somebody high up puts their foot down and bans Power BI.
Thank you all.
3 Replies
This forum here is the entirely wrong place to discuss these (valid) concerns. This must be a discussion between your company's legal team and Microsoft's legal team.
I think you may have misunderstood my question. I'm not looking to get the lawyers talking to one another, in fact I doubt Microsoft would even entertain an approach by one small company in the UK.
I just want to understand whether the points made by my head of IT are in fact valid or has he made some incorrect assumptions? I'm sure there will be somone in this forum who has some insight.
For example, is the statement "Microsoft are changing the way they do this, so that at some point, PowerBI will upload ALL our data to the Azure cloud, then sift through it from there." accurate? Because this doesn't sound right to me.
Likewise, the statement "as soon as the data leaves our systems, we have no idea what is happening, what it is being used for or by who. We assume Microsoft who use it for storage and processing purposes, but we can't be sure." also seems wrong, but where can we get reassurance on this?
If there is another, more appropraite forum, for these questions then I would be very grateful to be redirected.
Thanks again.
We have been through exactly the same exercise. You need to get your lawyers to talk to Microsoft lawyers and mention GDPR. They will talk.
