Adapting cybersecurity frameworks to manage frontier AI risks: A defense-in-depth approach
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866916358724255744 |
|---|---|
| author | Ee, Shaun O'Brien, Joe Williams, Zoe El-Dakhakhni, Amanda Aird, Michael Lintz, Alex |
| author_facet | Ee, Shaun O'Brien, Joe Williams, Zoe El-Dakhakhni, Amanda Aird, Michael Lintz, Alex |
| contents | The complex and evolving threat landscape of frontier AI development requires a multi-layered approach to risk management ("defense-in-depth"). By reviewing cybersecurity and AI frameworks, we outline three approaches that can help identify gaps in the management of AI-related risks. First, a functional approach identifies essential categories of activities ("functions") that a risk management approach should cover, as in the NIST Cybersecurity Framework (CSF) and AI Risk Management Framework (AI RMF). Second, a lifecycle approach instead assigns safety and security activities across the model development lifecycle, as in DevSecOps and the OECD AI lifecycle framework. Third, a threat-based approach identifies tactics, techniques, and procedures (TTPs) used by malicious actors, as in the MITRE ATT&CK and MITRE ATLAS databases. We recommend that frontier AI developers and policymakers begin by adopting the functional approach, given the existence of the NIST AI RMF and other supplementary guides, but also establish a detailed frontier AI lifecycle model and threat-based TTP databases for future use. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_07933 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Adapting cybersecurity frameworks to manage frontier AI risks: A defense-in-depth approach Ee, Shaun O'Brien, Joe Williams, Zoe El-Dakhakhni, Amanda Aird, Michael Lintz, Alex Computers and Society Cryptography and Security K.4.1 The complex and evolving threat landscape of frontier AI development requires a multi-layered approach to risk management ("defense-in-depth"). By reviewing cybersecurity and AI frameworks, we outline three approaches that can help identify gaps in the management of AI-related risks. First, a functional approach identifies essential categories of activities ("functions") that a risk management approach should cover, as in the NIST Cybersecurity Framework (CSF) and AI Risk Management Framework (AI RMF). Second, a lifecycle approach instead assigns safety and security activities across the model development lifecycle, as in DevSecOps and the OECD AI lifecycle framework. Third, a threat-based approach identifies tactics, techniques, and procedures (TTPs) used by malicious actors, as in the MITRE ATT&CK and MITRE ATLAS databases. We recommend that frontier AI developers and policymakers begin by adopting the functional approach, given the existence of the NIST AI RMF and other supplementary guides, but also establish a detailed frontier AI lifecycle model and threat-based TTP databases for future use. |
| title | Adapting cybersecurity frameworks to manage frontier AI risks: A defense-in-depth approach |
| topic | Computers and Society Cryptography and Security K.4.1 |
| url | https://arxiv.org/abs/2408.07933 |