Référent sécurité en Intelligence Artificielle/en

Le référent cybersécurité pour les data scientists est intégré dans leur environnement de travail. Il est leur point de contact privilégié pour assurer concrètement la prise en compte de la cybersécurité dans les projets IA qu’ils développent.

Catégorie : Commun Statut : ⧼cc-com-idée⧽ 1 : Idée - 2 : Prototype - 3 : Validation - 4 : ProductionMots clés : Formation, Vocation

What role for the cyber security advisor in Artificial Intelligence?

The cybersecurity advisor for data scientists :

• Ensures that the data science team implements the security requirements of their organisation and regulators, applicable to their working environment and the AI models produced;
• Maintains a culture and reflexes of cybersecurity in the data science team;
• Relays the needs of the data science team to the cybersecurity correspondents in his/her organisation.

Day-to-day activities

As a member of (or seconded to) a data science team, the cybersecurity advisor for data scientists must :

• Carrying out a daily security watch on the threats and vulnerabilities of AI models and their working environment (including languages, frameworks, libraries, infrastructure, etc.) so that the team can deal with them;
• Provide the team with the applicable cybersecurity solutions:

- Interact with the cybersecurity correspondents in his/her organisation to raise new needs and obtain appropriate solutions;

- Capitalising on/developing protection mechanisms, security function libraries, scripts, etc. to secure the models developed and their data;

- Monitor data science security solutions as they mature;

• Train colleagues in the cyber risks to which their environment and models are exposed, as well as in good security practices for development and data handling;
• Verify the application of security measures in their working environment;
• Help colleagues to integrate "by design" security into the models they design, in particular by integrating mechanisms to detect critical data leakage or model manipulation/deflection;
• Carry out code and model security reviews and validate before going into production.

Expected key competencies

Organisational skills

• Understanding of business issues, providing use cases to be developed to better anticipate harmful deviations from the model and better target dataset protection.
• Good knowledge of the organization's cybersecurity ecosystem/community
• Capitalization and transmission of knowledge;

Data science skills

A data scientist or ML engineer with

• Broad knowledge of the libraries used and available on the market
• Extensive knowledge of MLOps development platforms
• Proven experience of ML over the entire cycle: design, development, training/validation, integration

Cybersecurity skills

• Fondamentaux sur la cybersécurité (menace, analyse des risques, besoins, mécanismes, architecture, cloudsec)
• Capacité à organiser la veille sécurité (menaces, vulnérabilité, solutions) : source, traitement…
• Connaissance des types d’attaques sur l’IA et les principes de mitigation
• Connaissance pratique des mécanismes de protection des données, y compris sécurité du pipeline data (transfert, stockage, calcul) ou des extractions de jeu de données.
• Connaissance pratique de la sécurité des développements, y compris des risques « supply chain », opensource, git…
• Pratique de la revue sécurité du code

Groupe de travail

IA et cybersécurité