Utilizing the new ENISA report to build a comprehensive security strategy for AI

Looking for good practices re AI security? The new ENISA report can help. It shows the need for a broad strategy that takes into account various risks (including legal ones) regarding not just your machine-learning algorithm or other tool but also the data sources themselves and the expected output.

Bias, for instance, is not a cybersecurity risk as such – but it is a risk to the proper working of the tool. And inadequate security could lead to manipulation and increased bias.
The same goes for compliance with GDPR and other data protection rules – there are risks associated with non-compliance, and lack of security can cause non-compliance as well.

So when contemplating how your risk assessment methodology works in relation to AI projects, ensure it is broad enough to cover not only immediate and obvious information security risks – there is a whole lot more, and it’s best to bring in a range of experts.

See in particular the following recommendation from European Union Agency for Cybersecurity (ENISA):

“Longitudinal risk assessment. AI systems continue to learn and consequently evolve

after their deployment, meaning that vulnerabilities can be exploited at various stages

of their life cycle and thus risk evaluation cannot be static. Traditional methodologies

and tools are not efficient. New approaches to cover dynamic threat assessment and

RM are needed to cover the entire AI life cycle, which address not only technical but

also societal threats (e.g. bias, discrimination, lack of explicability, interpretability,

explainability, transparency, accountability).

Link: https://lnkd.in/e8PxKkaY