Chapter 4

Discussion Questions & Scaffolding

4.1: AI system advances often out-speed the necessary cybersecurity measures.

a. How can cyber practitioners close this gap to an acceptable level?
💡 The naive answer might be to use AI to deal with AI (the Chinese saying is 以毒攻毒). But would the uses of AI be different on the defensive side compared to the offensive side? Reason: the success criteria for offensive operations, and their starting points differ from defensive operations and their starting points.
b. Which other business functions besides cybersecurity typically lag AI advances? (We will discuss some of these challenges in Chapter 9.)
💡 Think about the types of AI initiatives that can be bolt-on (e.g. a third-party chatbot service) as opposed to AI initiatives that must be integrated with existing infrastructure (e.g. security tooling).

4.2: We used jurisdiction-aware RAG to manage dated legal sources.

a. Which data-location or collaboration requirements might justify federated learning instead?
💡 Consider industries where data privacy is legally enforced across borders. Example: healthcare in the US (HIPAA) or when dealing with European customers (GDPR). As of time of writing the book, there was too little opportunity to discuss the topic on sovereign AI, but it is worth a think: what does sovereign AI entail?
b. What are the trade-offs between context-aware RAG and federated models for these use cases mentioned?
💡 Think about the extent of separation of data between federated models and context-aware RAG. When might this be important?

4.3: We decomposed MLSecOps and discussed steps to incorporate security into existing MLOps pipelines.

a. Do the same analysis for AIOps and LLMOps. What are some differences in expectations?
💡 ML is a subset of AI. How do we generalize MLSecOps principles to AI in general, and what conditions are no longer true? Similarly, think about the business drivers behind LLM adoption as opposed to ML. How do the business drivers (e.g. velocity of product development and the target consumers of said product) influence implementation requirements, and hence introduce constraints on security?
b. Which differences arise due to technical differences, and which differences arise due to business/operational use cases?
💡 Hint 1: One way to think of technical differences: how would resource consumptions differ depending on how AI is deployed (ease of access is one such example, and another such example is the orchestration of AI agents)?

💡 Hint 2: One way to think of operational differences: recall in Part (a) the discussion on ML versus LLM implementations. The user journeys will significantly differ. Why is that the case, considering the types of users who will directly interact with the deployment?
c. Nowadays, many AI start-ups receive funding from venture capitalists. Expectations from venture capitalists are high, which implies the need to ship product fast, iteratively, and request for feedback. When does it make sense to introduce security into the LLMOps pipelines? (Note the subtle difference between LLMOps and MLOps.)
💡 Shipping fast is essential for survival, but a day-one data leak can instantly kill investor trust. How should start-ups navigate this challenge? It is also important to think of the current trend towards AI slop (Discussion 1.4).

4.4: We briefly mentioned MAESTRO, an agentic AI-based threat modeling framework. OWASP has provided an example of a threat model, using MAESTRO, on the Anthropic MCP framework.¹

a. How do Layers 3, 4 and 7 of MAESTRO complement one another to illustrate that this threat model is one targeted at AI infrastructure?
💡 Consider how an agent’s memory, orchestration logic, and external tool use create a continuous chain of trust.
b. Map the MAESTRO threat model in the OWASP document to MITRE ATLAS threats. Use MITRE ATLAS’s Maturity filter to comment on mapped threats.
💡 In essence, we are performing a quick threat modeling exercise. Use MAESTRO to identify AI assets and map them to applicable threats on those AI assets in MITRE ATLAS. These frameworks can be used complementarily to answer the first two questions of the Threat Modeling Manifesto.
c. What are the top threats to Anthropic’s MCP framework?
💡 Recall crown jewel analysis (CJA) in Chapter 2, and Discussion 2.3. Let me distill the sales pitches you may find on CJA if you Google in a few sentences. Three key points to CJA: (1) understand what the primary use case of the system is, (2) what systems are existential to maintain that primary use case and the cybersecurity properties associated with it and (3) demarcate using trust boundaries the scope of those systems.
d. Read Praetorian’s research work in Feb 2026 documenting MCP vulnerabilities through their tool, MCPHammer.² Using MCPHammer, they were able to exploit vulnerabilities such as third-party MCP server chaining, arbitrary file download and execution, supply chain attacks via package manager configuration as well as data exfiltration.

In brief, the vulnerabilities are as follows:
- Third-Party MCP Server Chaining: a malicious local MCP server ingests trusted, legitimate remote MCP servers as data sources that host malicious data to execute arbitrary commands locally.
- Arbitrary File Download and Execution: a trigger can be used to bypass initialization checks that are normally put in place (for the user to allow/deny) before a file is downloaded and executed
- Supply Chain Attacks via Package Manager Configuration: a legitimate MCP server is compromised, resulting in the facilitation of attacks such as watering hole attacks and vishing.
- Data Exfiltration: malicious MCP servers can query, access local resources, and leverage already authorized connectivity to perform data exfiltration.

What does the idea of “securing” MCP mean to you?
💡 Recall that MCP is infrastructure. This is re-phrasable as “securing” infrastructure.

¹ OWASPGenAIProject Editor. (2025, June 10). Multi-Agentic system Threat Modeling Guide v1.0. OWASP Gen AI Security Project. Link ² Copeland, J. (2026, February 17). MCP Server Security: The Hidden AI Attack Surface. Praetorian. Link

4.5: We have discussed how feedback and operational measurements can support quality and drift monitoring.

a. Why is model drift detection important?
💡 A model trained on last year's data might give confidently incorrect advice today, especially when frameworks change. (Fun fact: the author was trying to work on ISO27001 mapping once, and a naive prompting of ISO27k relevance on a LLM resulted in ISO27001:2013 material being returned as the accepted standard over the more updated 2022 version then. This is an example of the LLMs not realizing that the frameworks have drifted, for legitimate reason. And because the LLM couldn't be easily “untrained”, I had to work with this.)
b. For Shoppy, what feedback and performance measurements would distinguish a change in user needs from degraded recommendations? Define a baseline, review process, and escalation threshold.
💡 For instance, in South-East Asia, we periodically suffer from haze as a result of burning of palm oil plantations. Air pollution arising from this does not happen every year, though, which means whether an air purifier makes financial sense could differ due to the amount of short-term utility it provides for the user.
c. What other methods can be used to detect model drift?
💡 Think about automated statistical checks. Can you measure the mathematical difference between the current input data distribution and the original training data?
d. How would you handle incomplete, biased, contradictory or malicious feedback? Design acceptance tests and approval gates.
💡 Human reviewers often disagree on what is “helpful” versus “safe”. How do you define objective criteria? (This may not be as easy as it sounds!)

4.6: Discussion 4.1 alludes to how the progress of AI systems has made the job of securing them much more complex. One such challenge is the principle of least privilege (which we introduced in Chapter 2 and mentioned in Chapter 3).

a. Consider the Linux permission model in the context of determining users and user groups that have access to certain files and folders within the Linux file system³. Why does the principle of least privilege look straightforward to apply here?
💡 In Linux, the boundaries are rigid, deterministic, and easily visible on a single machine. Why does this make assigning read/write rules a straightforward administrative task?
b. Let us extend beyond the Linux permission model and analyze cloud systems. Many cloud providers incorporate native IAM solutions as a means of implementing the principle of least privilege. While the concept does not change too much from the Linux permission model, why is a cloud-based IAM so complex, and how does it affect the extent to which the principle of least privilege can be followed?
💡 Cloud environments involve thousands of ephemeral microservices, dynamic roles, and cross-account trusts. Even the concept of authentication has also evolved, including best practices such as short-lived authentication tokens. Cloud-based IAM can be a subject by itself!
c. Now let us apply this concept to a LLM chatbot. Comment on the ease of applying the principle of least privilege to LLMs that can access both unauthenticated and authenticated functions within the same chatbot. (We will extend on this conundrum further in Discussion 10.1 (c).)
💡 How would a chatbot's permissions be defined, if a chatbot has a wider range of functions it can do compared to more primitive features such as a search box and state-based functions on a web application? How does the AI differentiate between an innocent request and a malicious injection trying to cross that boundary, and to what extent can the AI differentiate such intentions accurately? (See Discussion 10.1 (c) for more on this conundrum.)

³ McBrien, S. (2023, January 10). Linux file permissions explained. Redhat.com. Link