AID-I-002: Network Segmentation & Isolation for AI Systems
Implement network segmentation and microsegmentation strategies using firewalls, proxies, private endpoints, and transport layer security to enforce strict communication boundaries for AI systems. This involves isolating internal components (e.g., training vs. inference environments, data stores) to limit lateral movement, and securing connections to external dependencies (e.g., MaaS APIs) to prevent data exfiltration, SSRF, and MitM attacks. The goal is to reduce the blast radius of a compromise by enforcing least-privilege network access both internally and externally.
Scope boundary
Owns network segmentation, microsegmentation, private connectivity, egress mediation, and measured reachability for internal and external AI communication paths, including agent listeners, discovery endpoints, callbacks, brokers, relays, and direct peer routes. It limits which identities and routes can connect but does not establish message identity or authorize message content.
AID-H-004.003: AID-I-002 controls network reachability between AI and agent components; AID-H-004.003 authenticates peer identity, protects channel and message integrity, prevents replay, and authorizes the A2A task. A permitted network path is not proof that a peer message is authentic or authorized, and secure messaging does not replace network segmentation.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0025 Exfiltration via Cyber Means
- AML.T0036 Data from Information Repositories
- AML.T0044 Full AI Model Access
- AML.T0049 Exploit Public-Facing Application
- AML.T0072 Cyber Communication Channel
- AML.T0075 Enterprise Resource Discovery
- AML.T0096 AI Service API
- AML.T0108 AI Agent
- AML.T0114 AI Service Web Interface
- AML.T0120 AI Artifact Repository
- AML.T0122 Exploitation of Remote Services
MAESTRO
- Data Exfiltration (L2)
- Compromised RAG Pipelines (L2)
- Lateral Movement (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- ML05:2023 Model Theft
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI07:2026 Insecure Inter-Agent Communication
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.031 Model Extraction
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-8.2 Data Exfiltration / Exposure
- AITech-9.1 Model or Agentic System Manipulation
- AITech-14.1 Unauthorized Access
- AITech-16.1 Eavesdropping
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- MXF: Model Exfiltration
- IIC: Insecure Integrated Component
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model 7.2: Model assets leak
- Model Serving - Inference response 10.2: Output manipulation
- Platform 12.4: Unauthorized privileged access
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.13: Rogue Agents in Multi-Agent Systems
- Agents - Tools MCP Server 13.23: Data Exfiltration
- Agents - Tools MCP Server 13.25: Insecure Communication