The Cybersecurity Risks Of Generative AI

We’re all still getting to grips with the exciting possibilities of generative AI as a technology that can create realistic and novel content, such as images, text, audio and video. Its use cases will span the enterprise, and include enhancing creativity, improving productivity, and generally helping people and businesses work more efficiently.

We are at a point of time in history where no other technology will transform how we work more drastically than AI is already doing.

However, generative AI also poses significant cybersecurity risks to your data. From seemingly innocuous prompts entered by users that may contain sensitive information (which the AI can then collect and store), to building large-scale malware campaigns, generative AI is nearly single-handedly expanding the ways in which sensitive information can be lost for modern enterprises.

For most LLM companies, they are just now starting to consider data security as part of their strategy and customer needs.

Businesses must adapt their security strategy to accommodate this, as generative AI security risks are revealing themselves as multi-faceted threats that stem from how users inside and out of the organisations interact with the tools. For many organizations, the risk is too high for them to allow generative AI tools into their organization and are seeking a secure path forward here.

What We Know So Far

Generative AI systems can collect, store, and process large amounts of data from various sources - including user prompts. This ties into the three primary risks facing organisations today:

Data Leaks:  If employees enter sensitive data into generative AI prompts, such as unreleased financial statements or intellectual property, then enterprises open themselves up to third-party risk akin to storing data on a file-sharing platform. Tools like ChatGPT or Copilot could also leak that proprietary data while answering prompts of users outside the organisation.

Malware Attacks:  Generative AI can generate new and complex types of malware that can evade conventional detection methods – and organisations may face a wave of new zero-day attacks because of this. Without purpose-built defence mechanisms in place to prevent them from being successful, IT teams will have a difficult time keeping pace with threat actors. Security solutions need to be using the same technologies at scale to keep up and stay ahead of these sophisticated attack methods.

Phishing Attacks:  The technology excels at creating convincing fake content that mimics real content but contains false or misleading information. This fake content can be used to trick users into revealing sensitive information or performing actions that compromise the security of the business. Threat actors can create new phishing campaigns – complete with believable stories, pictures and video – in minutes, and businesses will likely see a higher volume of phishing attempts because of this. Deep Fakes are being produced to spoof voices for targeted social engineering hacks and have proven to be very effective.

The three main security risks stemming from generative AI all follow one common thread: Data.

Whether it’s the accidental sharing of sensitive information or targeted efforts to steal it, AI is further amplifying the need for robust data security controls. 

Other Concerns  

Bias:  LLM’s can become biased in their responses and potentially give misleading or wrong information back out of models that were trained with bias information.

 Inaccuracies:  It has been seen that LLMs can accidently provide the wrong answer when analysing a question due to lack of human understanding and full context of a situation

Prioritizing Data Security Wherever Data Resides

Mitigating the security risks of generative AI broadly centres around three key pillars: employee awareness, security frameworks and technological solutions. 

Educating employees on the safe handling of sensitive information is nothing new. But the introduction of generative AI tools to the workforce demands consideration of the inevitable accompanying new data security threats. First, businesses must ensure employees understand what information can and can’t be shared with AI-powered solutions. Similarly, people should be made aware of the increase in malware and phishing campaigns that may result from generative AI.

The way businesses are operating is more complex than ever before - which is why securing data wherever it resides is a business imperative today.

Data is continuing to move from traditional on-premises locations to cloud environments, people are accessing data from anywhere, and keeping pace with various regulatory requirements is challenging. Traditional Data Loss Prevention (DLP) capabilities have been around forever and are super powerful for their intended use cases, but with data moving to the cloud, it is now clear that DLP capabilities also need to move while extending abilities and coverage. Organisations are now moving toward cloud-native DLP – prioritizing unified enforcement to extend data security across key channels. This approach streamlines out-of-the-box compliance and provides enterprises with industry-leading cybersecurity wherever data resides.

Leveraging Data Security Posture Management (DSPM) solutions allows for further protection for enterprises. AI-powered DSPM solutions enhance data security and protection by quickly and accurately identifying data risk, empowering decision-making by examining data content and context, and even remediating risks before they can be exploited. This prioritizes essential transparency about data storage, access and usage so that companies can assess their data security, identify vulnerabilities and initiate measures to reduce risk as efficiently as possible. 

Platforms that combine innovations like DSPM and DLP into a unified solution that prioritises data security everywhere are ideal – bridging security capabilities wherever data exists.

Successful implementation of generative AI can significantly boost an organisation’s performance and productivity; however, it is vital that companies are fully prepared for the cybersecurity threats such technologies can introduce to the workplace.

To best take advantage of exciting new tools while adequately protecting employees, organisations must prioritise security strategies that focus on protecting data wherever it resides with a strong focus on understanding their current data posture and the risks associated therein.

With this understanding, security practitioners will be empowered and able to take the necessary steps to reduce their risk posture quickly and accurately with minimal business impact.

Jaimen Hoopes is Vice President, Product Management at Forcepoint

Image: Allison Saeng

You Might Also Read:

What Can Be Done About Cyber Threat Actors Weaponizing AI?:

DIRECTORY OF SUPPLIERS - AI Security & Governance:

___________________________________________________________________________________________

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Hackers Target Healthcare
Securing The Supply Chain »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

Watch this webinar to see how cloud security posture management (CSPM) tools can fit into your cloud security strategy.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Ammune.ai

Ammune.ai

Ammune.ai (formerly L7 Defense) helps organizations to protect their infrastructure, applications, customers, employees, and partners against the growing risk of API-borne attacks.

Seceon

Seceon

Seceon OTM, is a cyber security advanced threat management platform that visualizes, detects, and eliminates threats in real time.

Advanced Systems International SAC

Advanced Systems International SAC

Advanced Systems international is a global company dedicated to data security software design, development, support, and licensing.

Naval Dome

Naval Dome

Naval Dome provides the first maritime multilayer cyber defense solution for mission critical onboard systems.

Digital Resolve

Digital Resolve

Digital Resolve delivers solutions that help companies maintain trust and confidence through proven and cost-effective fraud-protection and identity intelligence technology.

Securis

Securis

Securis provides organizations and agencies with the highest level of professional, ultra-secure data destruction and IT recycling.

GreenWorld Technologies

GreenWorld Technologies

GreenWorld has a proven track record in industry leading IT asset management, secure data destruction and remarketing.

ArmorText

ArmorText

ArmorText offers a seamless channel for communication and collaboration for organizations concerned with keeping communication data private and secure.

Blockchains LLC

Blockchains LLC

Blockchains is committed to changing the world for the better. Using blockchain and other innovative technologies, we’ll build new systems, new security, and new interactions.

Forum Systems

Forum Systems

Forum Systems is a global leader in API Security Management with industry-certified, patented, and proven products deployed in the most rigorous and demanding customer environments.

VISTA InfoSec

VISTA InfoSec

VISTA InfoSec is a global Information Security Consulting firm with offices based in US, UK, Singapore and India.

RB42

RB42

RB42 (formerly Nexa Technologies) provide cyber defense solutions (ComUnity, secure and encrypted messaging, detection of interception tools, etc) and cyber defense consultancy service.

Institute for Applied Network Security (IANS)

Institute for Applied Network Security (IANS)

For the security practitioner caught between rapidly evolving threats and demanding executives, IANS Research is a clear-headed resource for decision making and articulating risk.

Cura Technology

Cura Technology

Cura Technology offers a wide array of security solutions meticulously designed to address specific facets of your security requirements.

Issue53

Issue53

Issue53 is a complete technology solution provider offering Managed IT services, Network Security, Cloud Computing, and Data Backup and Recovery.

Internet Initiative Japan (IIJ)

Internet Initiative Japan (IIJ)

IIJ is one of Japan's leading Internet-access and comprehensive network solutions providers.