In this segment, we will sample some of Amazon Web Services that can play a part in data protection. The table AWS Service features with Data Protection provides a light sampling of services that you can leverage. For a complete list of AWS FIPs products check out: https://aws.amazon.com/compliance/fips/

Your source data used for training your AI may be in a format that is directly supported by AWS features, or you may need to transform the data for AI learning ingest. Regardless of data format, protecting the data at rest and in transit can leverage cloud provider, government approved FIPs protections. I'll consider specific FIPs topics in a future microblog.

Check out my recent blog with T-Rex: SECURE BY DESIGN AND ZERO TRUST: INTEGRATING SUPPLY CHAIN RISK MANAGEMENT WITH DEVSECOPS

In this blog, I’m focusing on the AI RMF MAP core function and aligning with CISA’s Data Pillar to provide a quick start in assisting on ensuring a Zero Trust approach to your AI endeavors.  Future blogs will cover the Govern anchor for the AI RMF core as well as the measure and manage functions.

Map: “Context is recognized and risks related to context are identified”

Although you need to work through the specifics of your AI system and most importantly your data sources to protect in your AI systems, the CISA Zero Trust Maturity Model 2 gives us a head start on approaching the mapping.

The two major functional concepts from the CISA Data Pillar and summarized for this blog are:

• Data - inventory, categorization, availability

• Data - protection and controls

For this example, we will go deeper on the protection and controls which will help you map your protection and show the aligning between ZT and AI RMF.

Data - Protection and Controls Snippet from Risk Catalog

Here are some sample risks that would be considered on an AI system that provides a web interface for user interaction and an API for the data query:

Risks:

1. Unauthorized access via AI APIs or AI BPIs API. Errors or manipulation of API provides direct access to agency data bypassing functional (safe) queries

2. Inline data points on premise or cloud can intercept protected traffic with network monitorin

Possible Controls Solutions:  API or BPI application level fireballing (native), or Standalone Application Level firewall, or LOAD balancers with API policy.

Summary

This alignment, at AI design kickoff will give you lift across both the NIST AI RMF and the CISA Zero Trust Maturity Model 2 and avoiding having to bolt on security later.

I will cover the other Core functions of the NIST AI RMF in future blogs.

References:

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0): https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf

CISA Zero Trust Maturity Model 2.0: https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf

This initiative addresses vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure appliances, which were actively exploited by cyber threat actors. The directive emphasizes immediate action to safeguard federal systems and underscores the importance of risk reduction across all organizations using these products.

Read more about this collaboration here: https://www.cisa.gov/news-events/news/cisa-omb-oncd-and-microsoft-efforts-bring-new-logging-capabilities-federal-agencies

#securebydefault #securebydesign #zerotrust

Integrating an SBOM capability into the DevSecOps process is recommended by the NSA and CISA in their multi-organization publication, “Securing the Software Supply Chain: Recommended Practices for Developers”. Here’s an article I wrote on the topic:

https://www.trexsolutionsllc.com/secure-by-design-and-zero-trust-integrating-supply-chain-risk-management-with-devsecops/

Linux Routing