Courtesy Capital Bank
By Christopher Conklin
Vice President, Chief Information Security Officer
Capital Bank, a division of Chemung Canal Trust Company
Cybersecurity Awareness Month is here once again. Most organizations with an existing awareness program will likely focus on password complexity, phishing and social media concerns. These topics continue to be the foundation of a good cyber security program. However, the sudden influx in the popularity of artificial intelligence (AI) has changed the game for cyber security due to the evolution of AI-born cyber-attacks. AI has gained prominence due to its ability to solve problems, reduce workloads and enhance customer experience. Opposite those benefits, artificial intelligence has concerns related to privacy issues, misinformation and enhancing existing cybersecurity threats. Related to existing threats, adversaries have learned to effectively weaponize AI to attack organizations. To better understand the threats, we first need to examine the benefits of utilizing AI.
Businesses today face a variety of challenges such as cost control, eroding customer confidence, and political and economic volatility, to name just a few. AI can change the way businesses address those issues. An article published last year by the Harvard Business Review indicated that more than 70 percent of U.S. businesses have already begun to utilize AI in some form. A common benefit of using AI is streamlining repetitive or mundane tasks such as data entry or customer support, which then frees up staff for more valuable tasks. AI can also provide analytical tools to process vast amounts of data and deliver actionable results for decision making. AI chatbots and virtual assistants can help provide 24/7 support by answering common questions, thereby improving response times and enhancing customer satisfaction.
Situations regarding volatility can be addressed by using AI to analyze data from various sources such news feeds, economic indicators, financial reports. The result is an analysis that could alert the business to potential warning signs. Forbes Magazine published an article in May further articulating the position that AI can assist leaders’ approaches to volatility. In it, the author cites that AI has the potential, if used correctly, to stay ahead of the challenges. While these benefits can help organizations, the use of AI comes with some concerns.
There exist several concerns regarding the utilization of AI. Some of those include data leakage/privacy issues, lack of oversight, deepfakes and adversarial cyber-attacks. The key element in the previously mentioned benefits is the access to data that’s required for an AI platform. It’s that access that generally creates the concern of data leakage for businesses. For an AI model to be effective it needs access to large amounts of data, including sensitive organizational data.
Consider a use case where a healthcare provider uploads patient information into an AI tool to diagnose or recommend treatment based on a vast set of already collected patient data and outcomes. If that AI tool is not properly protected, that patient information could be exposed to the Internet. Another possible scenario could be a financial institution looking to improve their credit-risk forecasting or channel optimization. To be successful, the AI tool would need access to a large amount of internal data, some of which could be considered confidential. The leaking of this data could potentially expose an organization’s strategic planning efforts or sensitive details relating to client data.
The risk of data leakage then leads us to the concern of lack of oversight with AI in an organization. Most vendors offering an AI-based platform don’t provide details as to how exactly the model works. Many see this as protecting their platform, but it often leaves organizations not knowing how the model works. The concept of a deepfake is another growing concern. It seems like a week doesn’t go by where there’s a story or posting regarding a deepfake being used. More concerning, threat adversaries have found ways to use AI tools to impersonate executives or create fake voice mail messages.
A popular use of a deep fake is impersonating an executive to transfer large amounts of money to an outside account. Adversaries are also using AI to create better phishing emails, more potent malware and bypass mechanisms for human-verification tools. If we take a closer look at phishing, we know in the past that most phishing emails often contained poor grammar or misspelled words. With AI tools, that’s no longer the case. AI-enhanced phishing attempts are extremely convincing and often appear to be from legitimate senders.
Artificial Intelligence is neither good nor bad. Organizations should weigh the value of utilizing AI and be on the lookout for when it is being used against them. As a first step, business leaders should ensure a governance mechanism is in place to evaluate when and how AI-based platforms are being used. Further, organizations opting to use AI to solve business problems should have a clear goal in mind for what they want to achieve. With a clear goal in mind, organizations can then ensure the proper controls are in place to protect limited amounts of data used by AI tools. Focusing on governance and oversight can help combat privacy and data leakage concerns.
An important step is to train employees in the appropriate use of artificial intelligence. Employees need to understand the possible benefits and pitfalls. Another consideration to be mindful of relates to contracts with vendors providing AI solutions. Organizations should ensure appropriate language is included in the contract to protect sensitive business data and outline consequences should that data be exposed impermissibly.
Whether a business chooses to adopt an artificial intelligence platform or not, the threat of AI being used against them remains. Organizations should update their educational efforts to include spotting AI-enhanced emails or other social engineering techniques. Some educational tips to include are looking for an unusual tone in the message or unexpected requests (i.e. the purchase of gift cards). With the consideration of benefits and threats in mind, businesses are better poised to safely and effectively utilize artificial intelligence solutions to achieve business goals.