Introduction
Before diving into AI-specific security techniques, every security engineer must have a solid grasp of fundamental security concepts. These principles form the bedrock upon which all advanced techniques are built. Regardless of whether you are defending a traditional network or an AI inference pipeline, these concepts apply universally.
This section covers the essential building blocks: attack surface analysis, the vulnerability lifecycle, defense in depth, the Principle of Least Privilege, Zero Trust architecture, and the AAA (Authentication, Authorization, Accounting) framework.
Attack Surface Analysis
The attack surface of a system is the sum of all points where an unauthorized user can try to enter or extract data. Reducing the attack surface is one of the most effective security strategies because it limits the number of potential entry points an attacker can target.
For AI systems, the attack surface extends beyond traditional network endpoints to include training data pipelines, model serving APIs, feature stores, annotation platforms, and model registries. Each of these components introduces potential vulnerabilities that must be identified and secured.
- Network Attack Surface: Open ports, exposed services, API endpoints, web applications
- Software Attack Surface: Code vulnerabilities, dependencies, configuration errors, unpatched systems
- Human Attack Surface: Social engineering targets, credential management, insider threats
- AI Attack Surface: Training data inputs, model APIs, feature engineering pipelines, model update mechanisms
The Vulnerability Lifecycle
Understanding how vulnerabilities are discovered, exploited, and remediated is essential for effective security management. The vulnerability lifecycle follows a predictable pattern that security teams must monitor at each stage.
- Discovery: A vulnerability is found by a researcher, attacker, or automated scanner. At this stage, it may be disclosed responsibly or kept secret (a zero-day).
- Disclosure: The vulnerability is reported to the vendor (responsible disclosure) or published publicly. A CVE identifier is typically assigned.
- Exploit Development: Proof-of-concept or weaponized exploits are created. The window between disclosure and patch availability is the highest-risk period.
- Patch Release: The vendor releases a fix. However, many organizations delay patching due to testing requirements, compatibility concerns, or resource constraints.
- Remediation: Organizations apply patches, update configurations, or implement compensating controls. The time from patch availability to full deployment is the patch gap.
Key Metric: The average time to patch a critical vulnerability is 60 days for most organizations. Attackers typically weaponize disclosed vulnerabilities within 7 days. This 53-day gap represents one of the most exploitable windows in enterprise security.
Defense in Depth and Zero Trust
Defense in depth is a security strategy that uses multiple layers of controls to protect assets. If one layer fails, subsequent layers continue to provide protection. This layered approach is particularly important for AI systems, where no single security control can address all threat vectors.
The Principle of Least Privilege states that every user, process, and system component should have only the minimum permissions required to perform its function. For AI systems, this means ML training jobs should not have production database access, inference services should not be able to modify model weights, and data scientists should not have administrative access to deployment infrastructure.
Zero Trust takes this further by eliminating implicit trust based on network location. In a Zero Trust architecture, every access request is authenticated, authorized, and encrypted regardless of where it originates. The mantra is "never trust, always verify." We dedicate an entire chapter (Chapter 12) to implementing Zero Trust with AI.
The AAA Framework
The AAA framework—Authentication, Authorization, and Accounting—provides a structured approach to access control that applies to both human users and AI systems.
- Authentication: Verifying identity. For humans, this includes passwords, MFA, and biometrics. For AI systems, this includes API keys, mutual TLS, and signed model artifacts.
- Authorization: Determining what authenticated entities are permitted to do. Role-based access control (RBAC) and attribute-based access control (ABAC) are common approaches.
- Accounting (Auditing): Recording what authenticated, authorized entities actually did. Comprehensive logging is essential for incident investigation, compliance, and training AI-based anomaly detection systems.
AI Connection: The AAA framework becomes even more important when AI systems make autonomous decisions. Every AI-driven action—blocking a connection, quarantining a file, escalating an alert—must be logged with sufficient context for human review. Without robust accounting, AI-powered security becomes a black box that no one can audit or trust.