Emerging Technology and Workforce Security
What to know
This domain covers new technology risk and the human layer. For emerging tech, reason about AI/ML risk: data poisoning, model theft, prompt injection, hallucination, and output trust; plus governance concepts like model inventory, human oversight, and evaluation. Know cloud-native and container risks: image provenance, orchestration misconfiguration, secrets sprawl, and infrastructure as code drift. Understand IoT/OT differences, where availability and safety outrank confidentiality, and why patching windows are constrained.
Know privacy-enhancing and cryptographic trends at a conceptual level: post-quantum migration planning and crypto-agility, confidential computing, and zero trust extending to workloads. For workforce security, understand insider threat programs, behavior analytics, and the balance between monitoring and privacy. Know secure hiring, role-based training, and offboarding rigor.
Traps
- Treating AI output as trusted data without validation.
- Assuming IT security practices transfer unchanged to OT.
- Ignoring secrets in code repositories and CI pipelines.
- Over-monitoring employees without legal and privacy review.
Worked example / rule of thumb
A team wants to connect an LLM to internal documents. Correct: classify data, restrict retrieval scope, log prompts and outputs, validate before action, and apply human approval for consequential steps. Rule of thumb: new technology inherits old risk plus a new attack surface; govern the data and the actions, not just the model.