Is AI A Security Risk, And What Should Be Done To Regulate It?

Nick Graham, Chief Technology Officer at information security software business Hicomply discusses the importance of balancing AI-based innovation with security considerations.

Earlier in the year, I wrote an article discussing the AI Hype Cycle, the proliferation of AI tools across a range of industries and how we are using AI at Hicomply to support our customers and make compliance easier.

But as the field of AI and automation grows exponentially, there’s clearly a need to have an open discussion around the security of AI and the need for regulation.

However, the European Parliament only approved the Artificial Intelligence Act in March of this year. It tackles the issue of safe and responsible AI usage. Notwithstanding the European Parliament’s steps, in the UK, we have yet to see any regulation come into effect. However, it is highly likely that a bill will be raised in the coming months or years.

Uk Government’s White Paper In 2023

However, we saw the UK government released a white paper in 2023 outlining how individuals and businesses could use Artificial Intelligence. Moreover, they pointed out how AI can help “to drive responsible innovation and maintain public trust in this revolutionary technology”.

Hicomply: What We Did And What Are We Up To

Here at Hicomply, the issues of trust and security are critical. We covered the addition of the AI functionality in my previous post.

Yes, our technology has taken on much of the heavy lifting in relation to logging, finding and searching through documentation. Our research and solutions base themselves on identifying organizational risks.

As a tech business focused on information security, however, it would be remiss of us to ignore the checks and balances required to mitigate AI-associated risks.

In February 2024, the UK government stated that it would take a “pro-innovation and pro-safety” approach to AI going forward.

The term “pro-safety” may be applied to concerns such as societal harms, risks relating to bias (either intentional or otherwise), misuse, and much more. One of the considerations for the team here at Hicomply relates to handling data protection and information accessibility via AI.

More specifically, it is incumbent on those who harness AI tools to ensure security against unlawful processing. It is also incumbent on those who are looking to evade accidental loss, destruction, or damage to personal data.

Undoubtedly, this has always been a consideration for companies that handle data manually. However, in harnessing AI, we must ensure that the programming of AI software is designed to safeguard against these issues.

AI systems undoubtedly add complexities that have never previously been found within IT systems, and they emphasize the issue of third-party code relationships with suppliers. The ICO has recently laid out this.

What Are The Security Risks Associated With Cybersecurity

In recent times, especially in the year 2023, different organizations have increased product methodologies.

The European Union Agency For Cybersecurity has published methodologies and frameworks which magnify the impending risks and challenges associated with the security of AI.

Poor Development Process

The pace at which organizations deploy generative AI applications is new and impressive but there are risks involved in it. Moreover, with the normal controls on software development and the absence of lifecycle management, things might be difficult and prone to risk.

Poor Security In The AI Application

The insertion of new network applications helps create new vulnerabilities, which could be exploited to access different network areas. However, here, the generative apps pose quite unique risks.

Thus, it is difficult for developers to identify the flaws associated with security. This is one area of Artificial intelligence where risks and uncertainties are associated with heaps of data.

Exposing The Most Confidential Corporate Information

Have you been using AI tools for quite some time recently? Then you have learned the role of a good prompt in extracting the best results. Moreover, you sent the artificial intelligence chatbots with the background information and context to get the best response.

Hence, in this process, you may be sharing proprietary or confidential information with the AI chatbot.

Therein lies the risk element associated with using artificial intelligence. According to a study and observation, around 11% of the data that the employees paste into the ChatGPT is confidential. Yes, it is quite confidential.

Moreover, 4% of the employees have pasted sensitive information, which is quite sensitive, atleast once in the ChatGPT. Yes, it is quite confidential, to say the least.

Also, the employees share intellectual property and sensitive company information without being fully aware or being serious about the consequences. This is where everything goes into the zone of risks and uncertainty.

How To Strengthen Security Against Risks Associated With Using AI?

In the previous section, we discussed some of the risks associated with AI. Hence, in this section, we discuss how to keep yourself safe and secure, or, say, strengthen your security posture.

Firstly, research the organization behind the application. You can evaluate an application’s reputation by tracking its records. This is one of the must-dos to evade risks associated with security risks revolving around artificial intelligence.

Secondly, the company must provide adequate training to its employees on the proper use of AI tools.

Thirdly, the employees within the organization must consider using security tools designed to prevent oversharing.

Lastly, you must start adhering to some of the traditional cybersecurity measures.

Keep the operating system and the software up-to-date.
Make use of Antivirus.
Tighten up your security credentials and use a highly strong password.
Have an application backup mechanism.
Finally, offer adequate training to employees.

Risk Of Data Breaches And Pinpointing Theft

When we share and reciprocate corporation information with software applications, we expect the companies to handle it responsibly.

However, with the help of generative tools, there always remains an opportunity to share more than the limits. Thus, we enter the risk zone associated with the use of AI.

Conclusion

At Hicomply, we work to ensure that the integration of AI sits within a broader, holistic approach to security and risk posture.

As we work to integrate useful AI functionality into our platform, we’re always looking to improve the strength and maturity of our risk management capabilities and document the changes in the scope and context of our datap processing.

As an innovative organization, we understand that progress must be balanced with security.

We aim to make our ISMS the most advanced, user-friendly, and comprehensive on the market today while ensuring that our customers’ sensitive data remains safe and secure with us.

Read Also: