Course Outline
Foundational Principles of AI and Security
- Distinct security attributes of AI systems compared to traditional software
- Comprehensive overview of the AI lifecycle: data acquisition, model training, inference, and operational deployment
- Classification of AI risks across technical, ethical, legal, and organizational domains
Threat Vectors Specific to AI Systems
- Adversarial examples and techniques for manipulating model behavior
- Risks associated with model inversion and the potential leakage of sensitive data
- Data poisoning vulnerabilities present during the training phase
- Security concerns in generative AI, including misuse of large language models and prompt injection attacks
Frameworks for AI Security Risk Management
- The NIST AI Risk Management Framework (NIST AI RMF)
- ISO/IEC 42001 and other standards dedicated to AI management
- Integration of AI risk management into existing enterprise governance, risk, and compliance (GRC) structures
Governance and Compliance Principles for AI
- Establishing accountability and ensuring auditability in AI implementations
- Transparency, explainability, and fairness as critical security properties
- Addressing bias, discrimination, and potential downstream harms to the public
Institutional Readiness and AI Security Policies for Government
- Defining clear roles and responsibilities within AI security programs
- Key policy components: development, procurement, authorized use, and decommissioning
- Managing third-party risks and the usage of supplier-provided AI tools
Regulatory Environment and Global Trends
- Overview of the EU AI Act and international regulatory developments
- Analysis of the U.S. Executive Order on Safe, Secure, and Trustworthy AI
- Emerging national frameworks and sector-specific regulatory guidance
Optional Workshop: Risk Mapping and Self-Assessment
- Mapping real-world AI use cases to the functions of the NIST AI RMF
- Conducting a foundational AI risk self-assessment
- Identifying internal gaps in AI security readiness and preparedness
Summary and Recommended Next Steps
Requirements
- Proficiency in fundamental cybersecurity principles
- Practical experience with IT governance or risk management frameworks
- Familiarity with general AI concepts is beneficial but not mandatory
Target Audience
- IT security teams
- Risk managers
- Compliance professionals
Testimonials (3)
inventory and identifying the different risk exposures within AI
Gary Cook - Cybersecurity and Information Technology Risk Division
Course - Introduction to AI Trust, Risk, and Security Management (AI TRiSM)
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
Patrick Collins - Optum
Course - OWASP GenAI Security
The profesional knolage and the way how he presented it before us