AI security dimensions

[vicenteherrera]

Contact Details

[email protected]

What is the idea

Hi friends,

During last meeting, I was mentioning how I see we all are refering to different lines of work for the group that I was refering as different "dimensions".

I think of these dimensions as possible themes in lines of works, or ways of extending the scope that exists in different directions at the same time. From the roadmap work we already know we want to extend on several of these, some of them sooner than others. Here is the list including some of the ideas we have been sharing in meetings.

Dimensions:

• Tech used:
  • Consider additional system architectures.
  • Fine tunning, open source models, ensemble architectures (multi/agent).
• Operationalization:
  • Describe details of how to implement the framework in a real project.
  • Would include validation, automated tests, integration with CCC & OSCAL.
• Incrementing threats and controls details:
  • Add Responsible AI / building trustworthy services.
  • Mapping to existing additional references, not only OWASP.
  • Create a chart to map in an appendix (make it easy for CISOs to achieve compliance).
• Group organization:
  • Framework maintenance: Transitioning from "living document" to "authoritative" with strict rules of change.
  • FSI: Have groups of interest not give feedback on the open, but anonymously to us under NDA.
• Extend Business Applications:
  * Consider additional use cases for threats and controls
  * Not only an internal user query: for trading information, customer support, emailing personalized information to external users.

Why is it a good idea

We can make sure we consider all dimensions and how we priorize them. We could organize people in streams depending of their expertise, or organize some specific thematic workshops from time to time.

How does it work?

Useful for the group

primer

artificial intelligence

Any other key information

No response

Code of Conduct

• I agree to follow the FINOS Code of Conduct