Threat Modelling and Cybersecurity Gap Analysis for Artificial Intelligence Platforms in Interior Design: Toward the Augmented Design Intelligence (ADI) Framework

Abstract

As Interior Designers increasingly use cloud-based AI (Artificial Intelligence) platforms, they are creating a burgeoning, potentially exploitable attack surface for cybersecurity risks. One critical risk area is that sensitive client information (e.g., home designs and photographs, unique design concepts, and financial information) can be processed by AI systems that lack the security protocols necessary to protect it. This paper describes a method for identifying and assessing potential cybersecurity threats to AI-enabled interior design platforms. We used the STRIDE methodology to identify types of threats and risks. STRIDE is an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Additionally, we employed the DREAD framework to assess the risk level associated with each STRIDE category. The DREAD approach uses Damage potential, Reproducibility, Exploitability, Affected Users, and Discoverability to define the severity of each threat. We built our threat model based on insights from 50 design pros and students about digital security issues. We asked them what they believe to be, "in their view", to elicit collective feedback & develop priorities. In doing so, we identified our top areas of risk by comparing our threats against two governing standards: the NIST Cybersecurity Framework and ISO/IEC 27001:2023. Our analysis involved a direct review of each standard's definitions against how existing AI Platforms actually operate today to identify which controls are deficient.