First, a refresher on why frameworks are so important. The two main reasons I mention when training or consulting a client are to ensure comprehensive coverage and to facilitate updates. A framework offers a complete list of controls and expectations for all known risks and vulnerabilities. If your risk management program lacks a framework, it is essentially 'just a bucket of best practices' (a phrase I once heard, and it stuck in my mind). The second reason is to make sure that as conditions evolve, the framework is updated, leading to your program incorporating those improvements. There are additional reasons as well, such as maintaining consistency in governance, ensuring compliance with your industry framework, and others.
Let's explore some of the lesser-known frameworks. MITRE's ATLAS Matrix is one that isn't widely discussed. The Adversarial Threat Landscape for Artificial Intelligence Systems (ATLAS) Matrix offers a comprehensive overview of potential threats to AI systems. This framework includes a detailed breakdown of malicious actor tactics and categorizes threats across various business sectors such as finance, healthcare, and others. It provides guidance on countermeasures and strategies to defend against attacks. For a clearer understanding of adversarial AI risks and effective management strategies, this framework is preferred.
Check out https://atlas.mitre.org to learn more about this AI framework.
In the next blog, we will discuss the Google Secure AI Framework (SAIF).
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →