F-TRAIDS

Project Objectives

We will investigate how to extend ISO 27005 information security risk management concepts and processes (identification of key assets; how they are affected by threats that can compromise them, which leads to risk; controlling measures to reduce the likelihood of a threat or mitigate the impact of a risk) to trustworthiness risk management. To address the complexity of risk modelling and assessment, we will use a system security modelling (SSM) platform to capture trustworthiness risk knowledge and automate risk assessment. The SSM implements ISO 27005, is designed to model risks within socio-technical systems and has been applied to a wide range of uses cases, including data protection compliance assessment and privacy risk assessment.

Our approach to trustworthiness risk assessment will be to model types of AI assets (SSM core ontology ways to model data and process) and the different consequences - virtuous attributes - (e.g., explainability, transparency, data quality, etc.) contributing to or reducing trustworthiness. We will then determine how these virtuous attributes are vulnerable or how they can be threatened leading to loss of trustworthiness. Finally, we will determine controls and control strategies that reduce vulnerabilities to loss of trustworthiness. We will demonstrate the principles for a representative set of AI systems using the SSM platform.