Page 259 - Cyber Defense eMagazine August 2024

P. 259

victim a great deal of time and money to handle. Flooding services and Crashing services are two
popular methods.
8. Prompt attack - These attacks include manipulative tactics where attackers deceive users into
revealing confidential information by exploiting security weaknesses in language learning models
used by AI-driven solutions like chatbots and virtual assistants. Ex - A security flaw found in Bing
Chat [5] successfully tricked models into spilling its secrets.
9. Unfairness and Biased risks - AI systems may create unfair results or promote social prejudices,
posing ethical, reputational, and legal issues. Given the fact AI solutions have potential to
revolutionize many industries and improve people's lives in countless ways, this biases and
unfairness may severely impact minorities, people of color, or users not well represented in the
training dataset. Ex - A face detection solution may not recognize non-white faces if those users
weren't added in the training set.

I would like to present the following recommendations to enhance the security of data models, MLOps
Pipeline, and AI applications. The best practices will provide security guardrails and monitoring of assets
while complying with regulations across respective geographies. AI models will be playing a critical role
in delivering competitive advantage to organizations, therefore AI process integrity and confidentiality
must be maintained by securing the most important assets and formulating the multi-prong approach to
achieve AI security.

Recommendations

1. Zero trust AI [6]: Access to model/data must be denied unless the user or application can prove
their identity. Once identified, the user should be allowed to access only the required data for a
limited period of time resulting in a least-privilege access, rigorous authentication, and continuous
monitoring. "Trust, but verify” approach to AI results in models being continuously questioned and
evaluated on a continuous basis - The Vault (secrets management), Identity and Access
Management (IAM), and multi-factor authentication (MFA) plays a central role here.
2. Artificial Intelligence Bill of Material (AIBOM): It's similar to Software Bill of Material (SBOM) but
prepared exclusively for the AI models, resulting in an enhanced transparency, reproducibility,
accountability and Ethical AI considerations. The AIBOM [7] details the building components
comprising an AI system's training data sources, pipelines, model development, training
procedures, and operational performance to enable governance and assess dependencies. A
suggested schema of AIBOM is referred [8] here.
3. Data Supply Chain - The access to clean, comprehensive, and enriched unstructured and
structured data is the critical building block for AI models. The enterprise AI Pipeline and MLOps
solutions supporting orchestration, CICD, ecosystem, monitoring, and observability are needed
to automate and simplify machine learning (ML) workflows and deployments.
4. Regulations and Compliance - "Data is the new oil" and each country [9] is implementing its own
rules to safeguard their interest. Organizations must adhere to AI data regulation and compliance
enforced in the respective region. A "human centered design approach" Ex - H.R. 5628

254 255 256 257 258 259 260 261 262 263 264