Question
A line of business wants to onboard an application that uses a custom AI model for employee assessments. The Chief Information Officer (CIO) agrees to allow the engagement to proceed but first wants a threat model. Which of the following is the most appropriate to use for an AI threat model?
- A. Responsible AI
- B. Adversarial Threat Landscape for AI Systems (ATLAS) Correct
- C. Organization for Economic Co-operation and Development (OECD)
- D. International Organization for Standardization (ISO)
Explanation
MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a knowledge base of adversary tactics and techniques against AI systems, modeled on ATT&CK, and is built for threat modeling AI applications. Responsible AI is a set of ethical principles, the OECD AI Principles are high-level policy guidance, and ISO standards define management systems and controls; none of these catalogues attacker techniques for a threat model.
