Risks and Vulnerabilities Across the DevSecMLOps Loop

All courses / AI Platform and Security / Module 2 / Chapter 9

Learning objectives

After the lesson the participant can:

• Identify the three recurring failures behind the reviewed incidents and the control that contains each.
• Explain why provenance is necessary but not sufficient.
• Assess an existing pipeline stage by stage and map its risks to Annex A controls.
• Draft a stage-risk register entry with controls, evidence, key risk indicators and an owner.

Key concepts

Mutable reference

A name such as a Git tag or a registry alias that can be pointed at different content while consumers keep trusting the name. The containing control is pinning by digest and commit SHA, because tags are not versions.

Rotate, do not rewrite

The rule for a secret pushed to a repository: revoke or rotate first and verify that the old value is rejected. Rewriting history strips signatures and leaves the data reachable in forks.

Limit of provenance

Provenance confirms which pipeline built an artefact, not whether that pipeline behaved as intended. It stays valuable because it makes compromise attributable, but the pipeline needs the same protection as its artefacts.

Unmanaged skills

A risk class with four forms: private copies that never receive fixes, unreviewed instructions, connectors of unknown origin and poisoned shared skills. The treatment is the governed catalogue with signing and review.

Risk register as code

The loop's risk register kept in the platform repository. Each entry names the stage, the risk, the controls with their Annex A mapping, the evidence, an owner and key risk indicators computed from manifests and logs.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A vulnerability with a modest severity score in a mirror turned out to matter greatly to the loop. Which component in your pipeline is more important than its score would suggest?
2. An auditor at Nordvik Region saw a control verified as effective with findings. Why might a recorded and corrected deviation be worth more than an unbroken series of passes?
3. Where in your pipeline do a tool, a credential and untrusted input meet in the same job, and who decided that they should?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which three failures does the chapter say recur across the incidents of 2024 to 2026?

   1. Weak passwords, missing backups and unpatched laptops
   2. Model drift, biased training data and missing model cards
   3. Unclear ownership, late testing and insufficient budget
   4. The mutable reference, the shared CI cache and the credential believed revoked but still valid
   Show the answer

   D. The mutable reference, the shared CI cache and the credential believed revoked but still valid
   Immutable digests, isolated release workflows, signed provenance and verified revocation address all three; the synthesis is the author's interpretation of the cases.

2. What does the May 2026 wave against the TanStack packages show, according to the chapter?

   1. That signed commits and hashed lockfiles make package registries safe to use without a mirror or a soak period
   2. That provenance confirms which pipeline built an artefact, not whether it behaved as intended
   3. That provenance attestations are of no value and should be dropped from the loop
   4. That a soak period is unnecessary once packages carry build provenance
   Show the answer

   B. That provenance confirms which pipeline built an artefact, not whether it behaved as intended
   The malicious packages were published through the project's own release workflow and carried valid build provenance, which shows the limit of provenance alone.

3. Where should the risks of the delivery loop be recorded, according to the chapter?

   1. In a separate AI risk register owned by the model team and reviewed once a month by the small catalogue board
   2. In the model card of each affected model version, under its limitations block
   3. In the organisation's information security risk register, treated through its selected Annex A controls
   4. In the supplier contracts, since most risks of the loop sit with suppliers and their release cycles
   Show the answer

   C. In the organisation's information security risk register, treated through its selected Annex A controls
   The loop's risks belong in the existing ISO/IEC 27001 register, not a separate AI register, and the register is held as code in the platform repository.