Defending the Loop's AI: Scenario Libraries, Findings and Emulation Agents as Tier 0

All courses / AI Purple / Module 4 / Chapter 16

Learning objectives

After the lesson the participant can:

• Explain why the loop's records are valuable to an adversary and to whom each asset is legitimately needed.
• Classify findings into the handling classes FC-1 to FC-4 by what their content would let a reader do.
• Draft a classification and access policy for a findings register of record, including agents and hosted models.
• Design detections of misuse of the loop's assets and the evidence that the protection works.

Key concepts

Tier-0 set of the loop

The findings register, the scenario library, emulation plans and rules of engagement, coverage records, and agent credentials, mandates and connectors. Together they are an adversary's best map of the estate and the records on which coverage claims rest.

Handling classes FC-1 to FC-4

FC-1 Aggregate: counts and trends with no asset named. FC-2 Redacted: technique, severity, owner and status. FC-3 Restricted: asset-specific detail of an open finding. FC-4 Exploitable: anything that would shorten an adversary's work, such as unreleased gap lists.

Register of record

The authoritative findings store, in its own store with its own identity group: append-only writes with an attributed change log, access policy enforced at a policy decision point, references in place of copies elsewhere, and second-person approval for exports.

Emulation agent as privileged insider

An agent that holds working credentials and tooling inside the estate. Five controls sit outside it: identity of its own, task-scoped credentials issued outside the runtime, default-deny egress and a separate range, no standing access to open findings, and an external stop path.

Deterministic redaction gateway

A rule-based gateway that replaces assets and accounts before a call to a model. FC-4 never goes to a model, FC-3 only to a model in the organisation's own environment, and a model asked to remove asset names has already seen them.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. At Nordvik Region the working copy of exercise findings lived in the managed provider's ticket system. Where do the findings of your last test live today, and how many people can read them?
2. The access review is the control that lapses first when a small team is busy. How do you design a control so that its lapse is visible?
3. The chapter handles insider risk by separation of duties and attributable records rather than by covert monitoring. What does that choice protect, for staff and for the loop?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Into which handling class does the list of priority techniques with no passing test fall?

   1. FC-4 Exploitable, for a named handful of people with a second person for any export.
   2. FC-1 Aggregate, because it is a summary for the board.
   3. FC-2 Redacted, because it names only technique identifiers and severities and not the affected assets.
   4. FC-3 Restricted, because it concerns open findings only.
   Show the answer

   A. FC-4 Exploitable, for a named handful of people with a second person for any export.
   An unreleased gap list would shorten an adversary's work, so it is FC-4. At Hansa Mutual the list of nine unverified priority techniques is the FC-4 gap list, while the board sees 25 of 34 as FC-1.

2. What access does the emulation runner have to the findings register in the chapter's design?

   1. Read access to the FC-3 findings for the systems in its signed scope, so that it can choose its next scenario.
   2. Full read access, so that it can avoid re-testing closed findings.
   3. No read of the register; it appends results and cannot delete, reclassify or export.
   4. Write access to change a finding's classification after a run.
   Show the answer

   C. No read of the register; it appends results and cannot delete, reclassify or export.
   The runner has a task-scoped identity, no read of the register and append-only writes. The side that tests does not hold the means to edit the record of what it found, which is where the independence principle reaches this chapter.

3. Why must redaction happen deterministically before a finding is sent to a model?

   1. Because models cannot process structured finding records.
   2. Because a model asked to remove asset names has already seen them.
   3. Because supervisors require redaction to be done by a person.
   4. Because redaction by rule is cheaper than a model call.
   Show the answer

   B. Because a model asked to remove asset names has already seen them.
   Redaction is done by a rule-based gateway before the call. A model that is asked to redact has received the unredacted content, so the exposure has already happened.