Catalog
STRIDE-AI analysis · TB7 boundary
The most exposed public boundary of the crisis voicebot: twelve threats analyzed in two parts, six classic STRIDE and six AI-specific. Initial ratings are deliberately conservative because the boundary is reachable without authenticated access and operates in a crisis context.
The six STRIDE categories applied to the public voice channel: what the classic framework sees, rated for a crisis service reachable by anyone.
An attacker uses a spoofed number or synthetic voice to impersonate a citizen, trusted organization or emergency caller.
Attacker crafts utterances or sequences that alter the intended workflow, captured fields or emergency context.
A caller disputes a malicious request, while the organization cannot reconstruct the prompt, transcript, model version or action.
Crafted dialogue causes disclosure of another caller's information, system prompts, emergency data or restricted configuration.
Automated calls, long interactions, SIP flooding or expensive prompts consume telephony, model or operator capacity.
The attacker convinces the bot that they are an administrator or triggers tools not authorized for public callers.
The six threats classic frameworks do not model: injection, jailbreak, hallucination, poisoning and tool abuse, where the model itself becomes the attack surface.
Caller says “ignore previous instructions” or frames an adversarial instruction to disable escalation or reveal controls.
Hidden or relayed instructions are introduced through external content, transcripts or retrieved text and treated as trusted instructions.
Role-play, translation, encoding or long-context strategies bypass refusal and output policies.
The model fabricates evacuation guidance, emergency status or citizen advice and presents it as authoritative.
Citizen-provided or externally sourced data is persisted into memory or the knowledge base and later treated as verified crisis information.
Prompt injection causes write access to databases, false dispatch, unsafe escalation or manipulation of connected workflows.
The nine assets exposed by the TB7 boundary, with their confidentiality (C), integrity (I) and availability (A) criticality.
| ID | Asset | Why it matters | C | I | A |
|---|---|---|---|---|---|
| A1 | Approved crisis instructions and workflows | Wrong or manipulated instructions can endanger citizens and emergency responders. | High | Critical | Critical |
| A2 | Chatbot behaviour / system prompt / intent allowlist | Defines permitted behaviour, output format and safety restrictions. | High | Critical | High |
| A3 | Citizen emergency information | May include phone number, location, state, persons at risk and evacuation details. | Critical | High | High |
| A4 | Chatbot service availability | Citizens must be able to reach the service during a crisis. | Medium | High | Critical |
| A5 | Administrative credentials and configuration | Compromise may affect multiple or all chatbot deployments. | Critical | Critical | High |
| A6 | Knowledge base / vector store | Must contain verified public information and approved procedures. | Medium | Critical | High |
| A7 | Audit logs and tool-call records | Required for detection, accountability and incident reconstruction. | High | Critical | High |
| A8 | Emergency-service integration | Incorrect escalation or dispatch can disrupt emergency operations. | High | Critical | Critical |
| A9 | Telephony and speech-processing path | Supports identity, audio confidentiality, real-time operation and availability. | High | High | Critical |
Each rating feeds a graduated response, enforced by the system and never left to the model's judgment alone. The full 20 control layers are in the checkpoints view.