On Purpose - Pre-Deployment
During the pre-deployment development stage, software may be subject to sabotage by someone with necessary access (a programmer, tester, even janitor) who for a number of possible reasons may alter software to make it unsafe. It is also a common occurrence for hackers (such as the organization Anonymous or government intelligence agencies) to get access to software projects in progress and to modify or steal their source code. Someone can also deliberately supply/train AI with wrong/unsafe datasets.
ENTITY
1 - Human
INTENT
1 - Intentional
TIMING
1 - Pre-deployment
Risk ID
mit608
Domain lineage
2. Privacy & Security
2.2 > AI system security vulnerabilities and attacks
Mitigation strategy
1. Implement Mandatory, Multi-Layered Access and Change Control for Development Assets. Enforce the Principle of Least Privilege (PoLP), Role-Based Access Control (RBAC), and Multi-Factor Authentication (MFA) across all critical development infrastructure, including source code repositories and AI training data environments. Mandate cryptographically signed commits and independent peer review for all code changes merged into production-bound branches to mitigate code sabotage and unauthorized alteration. 2. Establish a Comprehensive Data Integrity and Governance Framework for AI Datasets. Utilize cryptographic verification (e.g., checksums/hashing) to validate the integrity and immutability of all training, validation, and test datasets throughout the data lifecycle. Integrate continuous input validation, quality monitoring, and regular automated audits to detect and prevent malicious manipulation, such as data poisoning attacks, before models are trained. 3. Embed Automated Security Testing and Continuous Monitoring in the CI/CD Pipeline. Integrate Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) tools early in the Continuous Integration (CI) process to proactively identify code vulnerabilities and malicious injections. Augment this with Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA) for real-time monitoring of developer and system activity to detect anomalous behavior indicative of an insider threat or unauthorized access.