A city CISO sets architecture principles for municipal AI. Which secure-by-design trio best fits?
Select an answer to reveal the explanation.
Short Explanation
Build the lock before you hang the door. Least privilege, segmentation, and model integrity checks are the secure-by-design basics for city AI.
Full Explanation
Municipal AI security architecture should be secure by design, embedding least privilege, segmentation, and model integrity checks from the outset. Least privilege limits identities, service accounts, and pipelines to only the access required for their civic function, shrinking insider and credential-abuse blast radius. Segmentation (network, trust-zone, or workload boundaries) isolates training, serving, and sensitive resident data so compromise of one tier does not freely reach another. Model integrity checks—signing, checksums, verified promotion paths—ensure only approved artifacts reach production predictors that affect residents. Together, this trio forms a durable architecture baseline for city AI rather than bolt-on afterthoughts.
Maximum privilege, flat networks, and no integrity checks maximize lateral movement and silent model tampering. Applying security only after go-live with no least-privilege design accepts preventable exposure during the highest-change phases of delivery. Public write access to every model artifact by default invites unauthorized modification of systems that may drive benefits, routing, or safety decisions.
Exam caveat: “secure by design” means these controls are architectural defaults—not optional post-production patches. Do not confuse least privilege with “no access”; it is right-sized access.
Operational check: for each municipal AI system, document privilege matrices, trust-zone diagrams, and model signing/verification gates; block production release until the CISO confirms all three principles are implemented and testable.