This Cybersecurity Information Sheet (CSI) is the first of its kind release from the NSA Artificial Intelligence Security Center (AISC) – “intended to support National Security System owners and Defense Industrial Base companies that will be deploying and operating AI systems designed and developed by an external entity…while intended for national security purposes, the guidance has application for anyone bringing AI capabilities into a managed environment” across all industry sectors.  

Sections of this Post

1. NSA Publishes Guidance for Strengthening AI System Security
2. About the NSA AISC
3. NSA Sounds Alarm on AI’s Cybersecurity Risks
4. What Next?
   • Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems
     • Executive Summary
     • Scope and Audience
     • Introduction
5. OODA Loop Scenarios
6. Additional OODA Loop Resources

NSA Publishes Guidance for Strengthening AI System Security

“The AISC plans to work with global partners to develop a series of guidance on AI security topics as the field evolves…”

 “Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems” – is the first release from NSA’s Artificial Intelligence Security Center (AISC), in partnership with:

• Cybersecurity and Infrastructure Security Agency (CISA); 
• Federal Bureau of Investigation (FBI); 
• Australian Signals Directorate’s Australian Cyber Security Centre (ACSC); 
• Canadian Centre for Cyber Security; 
• New Zealand National Cyber Security Centre (NCSC-NZ); and
• United Kingdom National Cyber Security Centre (NCSC-UK). 

While intended for national security purposes, the guidance has application for anyone bringing AI capabilities into a managed environment, especially those in high-threat, high-value environments.  It builds upon the previously released:

• Guidelines for Secure AI System Development; and
• Engaging with Artificial Intelligence.

This is the first guidance led by the Artificial Intelligence Security Center (AISC) and postures the center to support one of its central goals: improving the confidentiality, integrity, and availability of AI systems.

About the NSA AISC

NSA established the AISC in September of 2023 as a part of the Cybersecurity Collaboration Center (CCC). The AISC was formed to detect and counter AI vulnerabilities; drive partnerships with industry and experts from U.S. industry, national labs, academia, the IC, the DoD, and select foreign partners; develop and promote AI security best practices; and ensure NSA’s ability to stay in front of adversaries’ tactics and techniques. 

The AISC plans to work with global partners to develop a series of guidance on AI security topics as the field evolves, such as on data security, content authenticity, model security, identity management, model testing and red teaming, incident response, and recovery.

NSA sounds alarm on AI’s cybersecurity risks

“Attack vectors unique to AI may attract malicious actors on the hunt for sensitive data or intellectual property, the NSA warned.”

As reported at Cybersecurity Dive:  

• The rapid adoption of artificial intelligence tools is potentially making them “highly valuable” targets for malicious cyber actors, the National Security Agency warned in a recent report.

• Bad actors looking to steal sensitive data or intellectual property may seek to “co-opt” an organization’s AI systems to achieve, according to the report. The NSA recommends organizations adopt defensive measures such as promoting a “security-aware” culture to minimize the risk of human error and ensuring the organization’s AI systems are hardened to avoid security gaps and vulnerabilities.

• “AI brings unprecedented opportunity, but also can present opportunities for malicious activity,” NSA Cybersecurity Director Dave Luber said in a press release.

• The report comes amid growing concerns about potential abuses of AI technologies, particularly generative AI, including the Microsoft-backed OpenAI’s wildly popular ChatGPT model.

• In February, OpenAI said in a blog post that it terminated the accounts of five state-affiliated threat groups who were using the startup’s large language models to lay the groundwork for malicious hacking efforts. The company acted in collaboration with Microsoft threat researchers.  “Cybercrime groups, nation-state threat actors, and other adversaries are exploring and testing different AI technologies as they emerge, in an attempt to understand potential value to their operations and the security controls they may need to circumvent,” Microsoft said in a separate blog post. “On the defender side, hardening these same security controls from attacks and implementing equally sophisticated monitoring that anticipates and blocks malicious activity is vital.”

• The threat activity uncovered by OpenAI and Microsoft could just be a precursor for state-linked and criminal groups to rapidly deploy generative AI to strengthen their attack capabilities, cybersecurity and AI analysts told Cybersecurity Dive. 

What Next? 

 Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems

“Organizations should consider the following best practices to secure the deployment environment, continuously protect the AI system, and securely operate and maintain the AI system.”

Executive Summary

Deploying artificial intelligence (AI) systems securely requires careful setup and configuration that depends on the complexity of the AI system, the resources required (e.g., funding, technical expertise), and the infrastructure used (i.e., on-premises, cloud, or hybrid). This report expands upon the ‘secure deployment’ and ‘secure operation and maintenance’ sections of the Guidelines for secure AI system development and incorporates mitigation considerations from Engaging with Artificial Intelligence (AI).  It is for organizations deploying and operating AI systems designed and developed by another entity. The best practices may not be applicable to all environments, so the mitigations should be adapted to specific use cases and threat profiles.  

AI security is a rapidly evolving area of research.  As agencies, industry, and academia discover potential weaknesses in AI technology and techniques to exploit them, organizations will need to update their AI systems to address the changing risks, in addition to applying traditional IT best practices to AI systems.

The goals of the AISC and the report are to:

1. Improve the confidentiality, integrity, and availability of AI systems;
2. Assure that known cybersecurity vulnerabilities in AI systems are appropriately mitigated; and
3. Provide methodologies and controls to protect, detect, and respond to malicious activity against AI systems and related data and services.

Scope and Audience

The term AI systems throughout this report refers to machine learning (ML) based artificial intelligence (AI) systems. These best practices are most applicable to organizations deploying and operating externally developed AI systems on premises or in private cloud environments, especially those in high-threat, high-value environments. They are not applicable for organizations who are not deploying AI systems themselves and instead are leveraging AI systems deployed by others.

Not all of the guidelines will be directly applicable to all organizations or environments. The level of sophistication and the methods of attack will vary depending on the adversary targeting the AI system, so organizations should consider the guidance alongside their use cases and threat profile. See Guidelines for secure AI system development for design and development aspects of AI systems.  

Introduction

The rapid adoption, deployment, and use of AI capabilities can make them highly valuable targets for malicious cyber actors. Actors, who have historically used data theft of sensitive information and intellectual property to advance their interests, may seek to co-opt deployed AI systems and apply them to malicious ends.

Malicious actors targeting AI systems may use attack vectors unique to AI systems, as well as standard techniques used against traditional IT. Due to the large variety of attack vectors, defenses need to be diverse and comprehensive. Advanced malicious actors often combine multiple vectors to execute operations that are more complex. Such combinations can more effectively penetrate layered defenses.

Organizations should consider the following best practices to secure the deployment environment, continuously protect the AI system, and securely operate and maintain the AI system.

The best practices [outlined in this report] align with the cross-sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections. 

For the full NSA AISC report, go to this link. 

OODA Loop Scenarios

The future scenarios for adversarial artificial intelligence (AI) attacks against the information technology infrastructure and critical infrastructure of the United States are alarming and complex. As a result, it is essential to recognize that the integration of AI into our digital and physical infrastructures not only enhances efficiency but also introduces novel vulnerabilities that can be exploited by adversaries: 

• One of the most concerning scenarios involves AI-driven cyberattacks that could target critical infrastructure sectors such as energy, transportation, and healthcare. These sectors increasingly rely on AI for operational efficiency and predictive maintenance. However, AI systems, by their nature, can be manipulated through techniques like data poisoning or model evasion. Adversaries could exploit these vulnerabilities to cause disruptions, manipulate data, or even take control of critical systems.
• For instance, an AI system designed to optimize grid operations in the energy sector could be tricked into misinterpreting input data, leading to incorrect actions that could cause widespread blackouts. Similar tactics could be used against other sectors, like transportation, where AI-driven logistics and traffic management systems could be disrupted, leading to chaos and economic damage.
• Another scenario involves the use of AI in disinformation campaigns. AI can generate convincing fake content, known as deepfakes, which could be used to manipulate public opinion, destabilize economic markets, or even incite civil unrest. This type of AI-enabled information warfare represents a significant threat to national security, as it targets the societal trust and cohesion necessary for democratic governance. 
• The proliferation of AI technologies means that these capabilities are not only accessible to nation-states but also to non-state actors, including terrorists and criminal organizations. These groups could deploy AI-driven attacks to achieve their objectives, further complicating the threat landscape. The democratization of AI tools and techniques could lead to a scenario where highly sophisticated cyberattacks are no longer the domain of well-funded state actors but could be launched by smaller groups with limited resources but sufficient technical knowledge. 
• To counter these threats, the U.S. must enhance its AI defenses. This includes developing robust AI systems against attacks, improving anomaly detection capabilities in critical infrastructure networks, and fostering a collaborative environment between the government, industry, and academia to share knowledge and best practices.
• Additionally, significant investment needs to be made in AI literacy and ethics training for professionals in critical sectors to ensure they are prepared to recognize and respond to AI-driven threats.
• The integration of AI into national defense and security strategies is also crucial. This involves defensive measures and the potential offensive use of AI to deter or neutralize threats before they can cause harm. However, this approach must be balanced with ethical considerations to prevent escalation and ensure compliance with international law.  

All told, the future scenarios for adversarial AI attacks are diverse and require a multi-faceted response strategy that includes technological innovation, regulatory frameworks, international cooperation, and ethical governance.  

NSA Publishes Guidance for Strengthening AI System Security

“The AISC plans to work with global partners to develop a series of guidance on AI security topics as the field evolves…”

 “Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems” – is the first release from NSA’s Artificial Intelligence Security Center (AISC), in partnership with:

• Cybersecurity and Infrastructure Security Agency (CISA); 
• Federal Bureau of Investigation (FBI); 
• Australian Signals Directorate’s Australian Cyber Security Centre (ACSC); 
• Canadian Centre for Cyber Security; 
• New Zealand National Cyber Security Centre (NCSC-NZ); and
• United Kingdom National Cyber Security Centre (NCSC-UK). 

While intended for national security purposes, the guidance has application for anyone bringing AI capabilities into a managed environment, especially those in high-threat, high-value environments.  It builds upon the previously released:

• Guidelines for Secure AI System Development; and
• Engaging with Artificial Intelligence.

This is the first guidance led by the Artificial Intelligence Security Center (AISC) and postures the center to support one of its central goals: improving the confidentiality, integrity, and availability of AI systems.

About the NSA AISC

NSA established the AISC in September of 2023 as a part of the Cybersecurity Collaboration Center (CCC). The AISC was formed to detect and counter AI vulnerabilities; drive partnerships with industry and experts from U.S. industry, national labs, academia, the IC, the DoD, and select foreign partners; develop and promote AI security best practices; and ensure NSA’s ability to stay in front of adversaries’ tactics and techniques. 

The AISC plans to work with global partners to develop a series of guidance on AI security topics as the field evolves, such as on data security, content authenticity, model security, identity management, model testing and red teaming, incident response, and recovery.

NSA sounds alarm on AI’s cybersecurity risks

“Attack vectors unique to AI may attract malicious actors on the hunt for sensitive data or intellectual property, the NSA warned.”

As reported at Cybersecurity Dive:  

• The rapid adoption of artificial intelligence tools is potentially making them “highly valuable” targets for malicious cyber actors, the National Security Agency warned in a recent report.

• Bad actors looking to steal sensitive data or intellectual property may seek to “co-opt” an organization’s AI systems to achieve, according to the report. The NSA recommends organizations adopt defensive measures such as promoting a “security-aware” culture to minimize the risk of human error and ensuring the organization’s AI systems are hardened to avoid security gaps and vulnerabilities.

• “AI brings unprecedented opportunity, but also can present opportunities for malicious activity,” NSA Cybersecurity Director Dave Luber said in a press release.

• The report comes amid growing concerns about potential abuses of AI technologies, particularly generative AI, including the Microsoft-backed OpenAI’s wildly popular ChatGPT model.

• In February, OpenAI said in a blog post that it terminated the accounts of five state-affiliated threat groups who were using the startup’s large language models to lay the groundwork for malicious hacking efforts. The company acted in collaboration with Microsoft threat researchers.  “Cybercrime groups, nation-state threat actors, and other adversaries are exploring and testing different AI technologies as they emerge, in an attempt to understand potential value to their operations and the security controls they may need to circumvent,” Microsoft said in a separate blog post. “On the defender side, hardening these same security controls from attacks and implementing equally sophisticated monitoring that anticipates and blocks malicious activity is vital.”

• The threat activity uncovered by OpenAI and Microsoft could just be a precursor for state-linked and criminal groups to rapidly deploy generative AI to strengthen their attack capabilities, cybersecurity and AI analysts told Cybersecurity Dive. 

What Next? 

 Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems

“Organizations should consider the following best practices to secure the deployment environment, continuously protect the AI system, and securely operate and maintain the AI system.”

Executive Summary

Deploying artificial intelligence (AI) systems securely requires careful setup and configuration that depends on the complexity of the AI system, the resources required (e.g., funding, technical expertise), and the infrastructure used (i.e., on-premises, cloud, or hybrid). This report expands upon the ‘secure deployment’ and ‘secure operation and maintenance’ sections of the Guidelines for secure AI system development and incorporates mitigation considerations from Engaging with Artificial Intelligence (AI).  It is for organizations deploying and operating AI systems designed and developed by another entity. The best practices may not be applicable to all environments, so the mitigations should be adapted to specific use cases and threat profiles.  

AI security is a rapidly evolving area of research.  As agencies, industry, and academia discover potential weaknesses in AI technology and techniques to exploit them, organizations will need to update their AI systems to address the changing risks, in addition to applying traditional IT best practices to AI systems.

The goals of the AISC and the report are to:

1. Improve the confidentiality, integrity, and availability of AI systems;
2. Assure that known cybersecurity vulnerabilities in AI systems are appropriately mitigated; and
3. Provide methodologies and controls to protect, detect, and respond to malicious activity against AI systems and related data and services.

Scope and Audience

The term AI systems throughout this report refers to machine learning (ML) based artificial intelligence (AI) systems. These best practices are most applicable to organizations deploying and operating externally developed AI systems on premises or in private cloud environments, especially those in high-threat, high-value environments. They are not applicable for organizations who are not deploying AI systems themselves and instead are leveraging AI systems deployed by others.

Not all of the guidelines will be directly applicable to all organizations or environments. The level of sophistication and the methods of attack will vary depending on the adversary targeting the AI system, so organizations should consider the guidance alongside their use cases and threat profile. See Guidelines for secure AI system development for design and development aspects of AI systems.  

Introduction

The rapid adoption, deployment, and use of AI capabilities can make them highly valuable targets for malicious cyber actors. Actors, who have historically used data theft of sensitive information and intellectual property to advance their interests, may seek to co-opt deployed AI systems and apply them to malicious ends.

Malicious actors targeting AI systems may use attack vectors unique to AI systems, as well as standard techniques used against traditional IT. Due to the large variety of attack vectors, defenses need to be diverse and comprehensive. Advanced malicious actors often combine multiple vectors to execute operations that are more complex. Such combinations can more effectively penetrate layered defenses.

Organizations should consider the following best practices to secure the deployment environment, continuously protect the AI system, and securely operate and maintain the AI system.

The best practices [outlined in this report] align with the cross-sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections. 

For the full NSA AISC report, go to this link. 

OODA Loop Scenarios

The future scenarios for adversarial artificial intelligence (AI) attacks against the information technology infrastructure and critical infrastructure of the United States are alarming and complex. As a result, it is essential to recognize that the integration of AI into our digital and physical infrastructures not only enhances efficiency but also introduces novel vulnerabilities that can be exploited by adversaries: 

• One of the most concerning scenarios involves AI-driven cyberattacks that could target critical infrastructure sectors such as energy, transportation, and healthcare. These sectors increasingly rely on AI for operational efficiency and predictive maintenance. However, AI systems, by their nature, can be manipulated through techniques like data poisoning or model evasion. Adversaries could exploit these vulnerabilities to cause disruptions, manipulate data, or even take control of critical systems.
• For instance, an AI system designed to optimize grid operations in the energy sector could be tricked into misinterpreting input data, leading to incorrect actions that could cause widespread blackouts. Similar tactics could be used against other sectors, like transportation, where AI-driven logistics and traffic management systems could be disrupted, leading to chaos and economic damage.
• Another scenario involves the use of AI in disinformation campaigns. AI can generate convincing fake content, known as deepfakes, which could be used to manipulate public opinion, destabilize economic markets, or even incite civil unrest. This type of AI-enabled information warfare represents a significant threat to national security, as it targets the societal trust and cohesion necessary for democratic governance. 
• The proliferation of AI technologies means that these capabilities are not only accessible to nation-states but also to non-state actors, including terrorists and criminal organizations. These groups could deploy AI-driven attacks to achieve their objectives, further complicating the threat landscape. The democratization of AI tools and techniques could lead to a scenario where highly sophisticated cyberattacks are no longer the domain of well-funded state actors but could be launched by smaller groups with limited resources but sufficient technical knowledge. 
• To counter these threats, the U.S. must enhance its AI defenses. This includes developing robust AI systems against attacks, improving anomaly detection capabilities in critical infrastructure networks, and fostering a collaborative environment between the government, industry, and academia to share knowledge and best practices.
• Additionally, significant investment needs to be made in AI literacy and ethics training for professionals in critical sectors to ensure they are prepared to recognize and respond to AI-driven threats.
• The integration of AI into national defense and security strategies is also crucial. This involves defensive measures and the potential offensive use of AI to deter or neutralize threats before they can cause harm. However, this approach must be balanced with ethical considerations to prevent escalation and ensure compliance with international law.  

All told, the future scenarios for adversarial AI attacks are diverse and require a multi-faceted response strategy that includes technological innovation, regulatory frameworks, international cooperation, and ethical governance.  

About the Author

Daniel Pereira

Daniel Pereira is research director at OODA. He is a foresight strategist, creative technologist, and an information communication technology (ICT) and digital media researcher with 20+ years of experience directing public/private partnerships and strategic innovation initiatives.