Defense in Depth + Rules of the Road
D2.4–2.6 + D4 — Securing AI + Governance/Risk/Compliance (19%)
Learning Objectives
- Enumerate prompt-injection and jailbreak categories (direct, indirect, multi-turn, role-play bypass) and mitigations
- Build a PII redaction pipeline that sanitizes LLM inputs and outputs (names, emails, SSNs, PHI)
- Apply log sanitization to remove sensitive data from AI system audit logs
- Complete a NIST AI RMF 1.0 mapping worksheet (Govern, Map, Measure, Manage) for a real AI deployment
- Relate NIST AI 600-1 GenAI Profile controls to the lab scenarios
- Describe how EU AI Act risk tiers apply to AI-assisted security tools (high-risk deadline: 2 Dec 2027)
Lecture Notes
The objectives above are the full picture of what Day 3 covers. Lecture notes, slides and lab guides are released when we get there, so the room works through them together.
Lab Guide & Bundle
Lab guides and downloadable bundles appear here when Day 3 opens.
End-of-Day Quiz
Check for understanding — reveal the answer after you've chosen. No score is recorded.
Data can be protected in three states. Which control specifically protects data 'in use' — while it is being actively processed in memory by the model?
Reveal answer
Correct: C. Confidential computing / trusted execution environments (encryption in use)
Encryption in transit (TLS) protects data on the wire; encryption at rest protects stored data; encryption in use — confidential computing / TEEs — protects data while it is decrypted and being processed. AI inference exposes the 'in use' state, which is why it gets special attention.
In the Day 3 lab, an HR assistant holds employee SSNs in its context and attackers try to exfiltrate them. Which control most reliably eliminates the data-exfil attack surface?
Reveal answer
Correct: B. Redacting/anonymizing PII at the input layer with Presidio before it ever enters the context
You cannot leak what is not there. Redacting PII at the input (Microsoft Presidio detects PERSON, US_SSN, EMAIL, etc. and replaces it with placeholders) removes the sensitive data from the context entirely. Model refusal and alignment are unreliable and must not be treated as a data control.
NIST AI RMF 1.0 is organized around four core functions. Which set is correct?
Reveal answer
Correct: B. Govern, Map, Measure, Manage
NIST AI RMF 1.0 uses Govern, Map, Measure, Manage. (Identify/Protect/Detect/Respond/Recover is the NIST Cybersecurity Framework — a common distractor.) The lab worksheet maps the HR-chatbot scenario to these four functions; NIST AI 600-1 adds a Generative AI Profile of controls on top.
Under the EU AI Act, what is the provisional (Digital Omnibus, pending adoption) deadline being tracked for high-risk AI system obligations in this course?
Reveal answer
Correct: C. 2 December 2027 (deferred, provisional)
The course tracks the deferred high-risk obligations date of 2 December 2027 (provisional, per the Digital Omnibus proposal, pending final adoption). Always flag it as provisional and re-verify at content lock, because EU AI Act timelines have shifted.
'Shadow AI' in an organization refers to what?
Reveal answer
Correct: B. Employees using unsanctioned AI tools/services outside governance, risking data leakage and compliance gaps
Shadow AI is the AI analogue of shadow IT: staff pasting sensitive data into unapproved chatbots or standing up ungoverned AI features. It bypasses data-protection and responsible-AI controls, which is why discovery and policy (a Govern-function concern) matter.