A county CISO sets rules for AI-assisted offensive labs. Which data-handling rule is most important?
Select an answer to reveal the explanation.
Short Explanation
Do not feed the public chatbot your Defender exclusion grocery list while 'tuning' lab malware. That is OPSEC 101 for the county. Local notes beat leaking the keys to the castle.
Full Explanation
County CISOs setting rules for AI-assisted offensive labs must prioritize data handling: staff must not paste internal Defender exclusions or similar sensitive configs into public LLM chats while improving lab malware. Exclusion lists reveal where municipal defenses are intentionally blind; leaking them to public models can train third parties on county weaknesses and violate OPSEC and confidentiality policies. Lab malware tuning must use synthetic or sanitized configs inside controlled environments instead.
Pasting all Defender exclusion lists into public LLM chats to speed sample tuning is exactly the prohibited behavior. Internal telemetry is not safer in public models than in local lab notes—the opposite is true. OPSEC rules apply during lab work, not only after samples leave the county; leakage often happens at prompt time.
Exam caveat: the most important data-handling rule is the ban on pasting sensitive Defender exclusions (and similar) into public LLMs—not delaying OPSEC until after external sharing.
Operational check: publish a county AI data-handling standard listing banned paste classes (exclusions, secrets, network diagrams, identity exports), enforce DLP where possible, and require local/air-gapped models for any offensive-lab prompt work that needs realistic defensive context.