Cybercrime is an ever-present threat, and the continued advancement of Artificial Intelligence only serves to amplify the threat. As such, it is essential that the enterprise community is aware of the potential risks associated with AI adoption in their organization, and take the necessary steps to protect their data.
I’ve been in the IT industry for well over three decades, and my peers and clients all agree that the rapid evolution of easy-to-use Artificial Intelligence (AI) engines such as ChatGPT can provide the potential for us to asymmetrically advance our businesses and technologies at rates we’ve never seen before. These Large Language Models (LLM), including natural language processing (NLP) engines, learn based on how we humans interact with them.
Organizations that rely on any form of technology risk being left in the dust by their more agile competitors if they don’t consider the potential implications of how AI chat may (or may not) allow for rapid evolution.
So, what’s to worry about?
AI chat can pose a risk to organizations by potentially exposing corporate secrets, customer information, and intellectual property. While droves of technologists (note: you don’t even have to be a programmer to write a program!) have found great value in using ChatGPT to refine code or double-check work, what do we know about the collection of that data, where it goes or, how it could potentially be used?
Training data extraction attacks, also known as "exfiltration via machine learning inference," could gather sensitive information or steal IP, according to MITRE's Adversarial Threat Landscape for Artificial-Intelligence Systems (Atlas) knowledgebase. By querying a generative AI system in a special way (think of it as digital interrogation) an “attacker” (which may also just be a very curious researcher) may trigger the model to recall a specific piece of information, rather than generate synthetic data.
Given the current state of AI, almost all models require a human chaperone.
These things are like a highly knowledgeable and somewhat sociopathic teenager: they lack the intelligence and wisdom to act appropriately or understand what is appropriate in a particular situation.
Where to start?
Better yet, as I’m a believer in drinking my own champagne (doing what I tell others to do), I asked ChatGPT if it could generate advice on how to best protect my IP as it pertains to using AI chat for development purposes.
This was the output (along with my comments).
Another thing to monitor is how the software vendors are addressing privacy and security concerns to their offering. Last week, Microsoft announced Office 365 Co-Pilot, basically a ChatGPT add-in for all Office products (only available to a small group of beta users now, some Fortune 500 companies). This tool allows a business user to generate notes, email, presentations, spreadsheets, etc., based on the information the user has in Office.
Microsoft recognizes the concerns many have and has stated, “Copilot presents only data that each individual can access using the same underlying controls for data access used in other Microsoft 365 services. Additionally, we do not use customer data to train or improve the large language models used to generate content.”
A funny thing I’ve been saying since the mid-80’s (where the null hypothesis has yet failed to be disproved) is:
“With each and every advance in artificial intelligence, we have an equal
and opposite advance in artificial stupidity.”
While we are all about to strap in for a wild, and perhaps the most exciting ride in our IT lifetimes, we need to approach use of these new technologies with eyes wide open. While the guidelines above are a start, we are all going to learn a heck of a lot about advancing our organizations as well as the pitfalls that some suffer by not adequately thinking through what could go wrong.
For now, the guidelines above can help you mitigate the risk of leaking intellectual property through AI chat platforms like ChatGPT, therefore protecting your organization's assets, reputation, and clients. But tune in again shortly as the journey is just beginning, and who knows… perhaps ChatGPT will pick up some of my insights to further enrich us.
For your reading pleasure:
At Online, we understand the implications of AI on cybersecurity, and have a wealth of experience in helping organizations both take advantage of the power of AI while navigating the various risks involved with integrating AI.
Our team of experts can help to identify potential blind spots and vulnerabilities pertaining to your systems and your adaptation of new technologies, and develop strategies to mitigate these risks. We can also provide guidance on how to best implement AI in a secure manner to help ensure that your intellectual property and data remain safe. If you are looking to take advantage of the opportunities that AI presents but need help to understand the potential risks, then please get in touch with us. We can provide tailored advice on how to safely and securely implement AI, helping to ensure that your organization remains safe from cybercrime.”
As Vice President, Risk, Security and Privacy and Online's Security Officer, Steve is responsible for building, growing, and leading a pragmatic, risk-based, business-minded practice focusing on governance/program management, vulnerability management, and data protection.
Steve is a CISSP with over twenty years of information security experience and over thirty years of IT experience. He holds an MBA from Emory Business School and an Industrial Engineering degree from Georgia Tech. Prior to joining Online, Steve helped lead the consulting practices at AT&T Consulting and at Verisign and he has extensive experience in the Payment Card Industry.