AI systems are attractive targets for cyberattacks, especially because they process sensitive data and may be included in decision-making processes (see attack vectors in Figure 1). Comprehensive security measures and regular security checks are therefore of the utmost importance.
DORA requires financial entities to develop ICT security policies (Article 9(2) of DORA). AI systems should also be adequately considered in these policies. In particular, the policies should include measures for network security, data transmission (Article 2(1) of the RTS RMF) and protection against data misuse. For AI systems, this means that, in addition to securing model access, secure data sharing between training data, model components and end users should also be ensured.
System security. Robust data and system security (Article 11 of the RMF RTS) is essential for combating cyberattacks. Proactive defence mechanisms based on threat analyses and up-to-date security information are necessary.
Certain measures have proven to be effective in this regard:
- using firewalls, IDS/IPS systems and zero-trust models to prevent attacks on the AI infrastructure;
- using data loss prevention (DLP) mechanisms to prevent unauthorised access to AI data;
- specialised resilience tests for AI systems to validate their resistance to AI-specific risks, such as adversarial attacks and data set manipulation.
Network security. In addition, network security must be guaranteed at all times. The networks in which ICT and AI systems are operated must be segmented based on their criticality and protected against unauthorised access. Special measures must be implemented (e.g. firewall rules, encryption of network communication) to ensure the integrity and confidentiality of data traffic (Article 9 of DORA and Article 13 of the RTS RMF).
Financial entities establish network security policies and procedures that address specific requirements for AI systems. Ideally, the criticality and importance of AI systems should also be appropriately reflected in the separation and segmentation of ICT systems and networks (Article 13(a) of the RTS RMF). As AI systems can process confidential information, entities are encouraged to apply risk-based physical and/or technical protection for network access.
A number of security measures have become established for network hardening:
- using web proxies to examine, monitor and secure network traffic, considering all unencrypted and encrypted communication;
- using web application firewalls and API gateways to filter attacks at application level;
- protecting AI systems from DDoS attacks from the internet;
- establishing VPN and remote desktop access and automatically terminating remote sessions.
Authorisation management. Strict access controls and authorisation management systems are necessary for preventing unauthorised access to sensitive data. Consequently, authentication and authorisation procedures must be implemented to restrict access to sensitive data. Comprehensive logging of all data access attempts and modifications is necessary for identifying and tracking suspicious activity. Role-based access control (RBAC) systems can ensure that users only have access to the data they need for their work (Article 9(4)(c) of DORA and Article 21(a) of the RTS RMF).
Monitoring and logging. Entities are encouraged to log all relevant events and activities in AI systems. The purpose of logging is to ensure reproducibility and detect anomalous activities, and it is typically protected against manipulation (Article 12 of the RTS RMF).
ICT change management. For emergency changes to AI systems, special approval and assessment processes can be defined that enable changes to be made at short notice (Article 17(1)(f) and (g) of the RTS RMF).
Resilience testing. DORA also requires financial entities to conduct regular resilience testing (Articles 24, 25 of DORA). Advanced testing based on TLPT is not considered here (Articles 26 to 27 of DORA).
Numerous measures have proven effective to ensure AI system cybersecurity. These include:
- continuous real-time monitoring of AI systems for anomalous behaviour (e.g. unexpected decision patterns);
- establishing protective mechanisms against adversarial inputs, e.g. using filter mechanisms;
- logging the relevant output of the AI system and API calls for subsequent analysis;
- regularly updating the AI system to counter new threats;
- having a contingency plan for handling security incidents in the AI system.