A parks kiosk biometric breach involves model embeddings, yet IR treats the event as a routine password reset. What should the auditor emphasize?
Select an answer to reveal the explanation.
Short Explanation
You can't fix stolen embeddings with standard password rotations or service-credential resets. Calling them maintenance telemetry or logging inventory details won't contain the breach. You need AI-aware incident response instead.
Full Explanation
Recognizing AI-artifact breaches—compromised embeddings and models—in incident response works because biometric kiosk systems store derived representations that can enable impersonation, re-identification, or model theft even when ordinary passwords remain intact. Treating an embeddings compromise as a routine password reset under-scopes containment: rotations may not invalidate stolen vectors, poisoned models, or exfiltrated feature stores. Municipal parks IR must classify AI artifacts as sensitive assets with tailored forensics, revocation, re-enrollment, and vendor coordination steps.
Resetting kiosk service credentials and rotating volunteer passwords using standard account procedures fails because standard account rotations do not remediate stolen biometric embeddings or model files on the kiosk backend. Classifying biometric embeddings as operational telemetry for review during scheduled system maintenance fails conceptually by mapping an active digital AI-artifact breach to a routine maintenance queue with incompatible evidence and recovery actions. Updating kiosk asset inventory with model version details to strengthen lifecycle traceability controls fails as immediate response because traceability work does not contain an active biometric breach or stop ongoing misuse.
Exam caveat: not every credential reset is an embeddings breach—confirm artifact access in logs and storage before invoking full biometric IR, or you will overlook model-artifact compromise behind routine account activity. Operational check: update parks IR runbooks with an AI-artifact playbook (inventory embeddings/model stores, revoke or rotate keys, re-enroll biometrics where required, notify affected patrons per policy), and exercise it with a tabletop that distinguishes standard account procedures from model-artifact compromise.