Proprietary data
Access to sensitive company data [473]
ENTITY
2 - AI
INTENT
2 - Unintentional
TIMING
3 - Other
Risk ID
mit1410
Domain lineage
2. Privacy & Security
2.1 > Compromise of privacy by leaking or correctly inferring sensitive information
Mitigation strategy
1. Deploy real-time Data Loss Prevention (DLP) with Semantic Analysis: Institute advanced DLP solutions and inline AI gateway security controls to dynamically inspect, classify, and redact proprietary information within both user prompts and model responses. This establishes an essential technical barrier to prevent the unintentional or malicious exfiltration of sensitive organizational data. 2. Enforce the Principle of Least Privilege and Robust Access Controls: Implement stringent Role-Based Access Control (RBAC) to ensure AI models and their associated users can only access the minimum proprietary data necessary for their defined task. Complement this with end-to-end encryption for all sensitive data utilized by the AI system, both at rest and in transit, to mitigate risks associated with unauthorized access. 3. Integrate Privacy-Preserving Techniques in the Machine Learning Lifecycle: Apply data anonymization, pseudonymization, and differential privacy during data preprocessing to safeguard individual records. Furthermore, utilize rigorous, non-overlapping data splitting methodologies and train models to minimize overfitting, thereby reducing the probability of model memorization and subsequent inference-based leakage of proprietary training data.