课程: Security Risks in AI and Machine Learning: Categorizing Attacks and Failure Modes

Security goals for ML: CIA

课程: Security Risks in AI and Machine Learning: Categorizing Attacks and Failure Modes

开始一个月试用

Security goals for ML: CIA

“

- [Instructor] CIA. Confidentiality, integrity and availability are the foundational security goals. As security practitioners, we understand the importance of incorporating those goals into our workflows and our systems. And as we bring new technologies like AI and ML into the mix, we need to extend our CIA, confidentiality, integrity, and availability mindset to these new technologies. In addition to categorizing failure modes as either intentional or unintentional, they can also be assessed depending on which part do the CIA triad they impact. Keep in mind that some failure modes have crossover impacts, and span across security goals. While all failure modes matter, and should be addressed, due to resource and time constraints, that's not always possible. Therefore, it's helpful to be able to understand which goals of failure mode impacts to help with prioritization work. If the AI or ML failure mode results in exposure of private data, that impacts the goal of confidentiality. Model inversion. When an attacker is able to learn sensitive information about individuals by querying that machine learning API, application programming interface, is one example of this. For organizations that must meet strict privacy regulations, the confidentiality security goal will be high priority. Failures that result in unreliable or inaccurate model outputs impact system integrity. If an attacker intentionally poisons the data set either during training or in use, the output of the model will be tainted. In models that are used to predict outcomes, like is it going to rain today, can result in skewed or useless projections if they've been poisoned. And finally, whether a system can be access or not relates to availability. In machine learning, existing software dependencies, and attacks such as buffer overflows, and distributed denial of service, DDoS, can impact that availability as they would any other piece of software. If five nine's uptime of the system is a high priority as it often is in production environments, then focus on reducing, and mitigating failure modes that cause disruptions and availability. As you go through this course, keep CIA in mind, and consider how you would classify each of the failure modes against your own corporate security goals.

内容