AI Evolution and the Impacts on Cyber Security for Enterprises: Potential, Threats, and Controls

As Artificial Intelligence (AI) rapidly evolves, its relevance across industries is gaining recognition. AI and machine learning technologies continue to disrupt the traditional ways business is conducted and, consequently, are raising the standards for business optimisation worldwide. But AI offers as much potential as it does threats for organisations; whilst business owners and enterprises strive to leverage AI to optimise their performance, cybercriminals are also taking advantage of this sophisticated technology. Unfortunately, machines have no conscience; they execute tasks as instructed with unmissable precision, even if that instruction is malicious – except if something alters its course. This is why enterprises should be looking to leverage AI, not only to facilitate business growth and success, but also to gain insight into potential attacks and appropriate security controls that should be implemented to help you stay ahead of cybercriminals and protect your business from threats.

Benefits of Harnessing AI for Businesses

The rate at which the global market adopts AI continues to surge, mainly due to the incentives associated with AI. Goldman Sachs recently found that AI can raise the global GDP by a whopping $7 trillion within the next decade. CSIRO also reported that 68% of Australian businesses have adopted and implemented AI technologies in their enterprises and have further confirmed the possibility of this rising to 91% by March 2024.

Simply put, Artificial Intelligence can streamline business processes and provide insights through simplifying and analysing data. These days, data is treated as currency, and we live in a data-rich and data-driven world. You would be hard-pressed to find an industry today, from mining to manufacturing, health, security, hospitality, or even education, that is not dependent on data – and in huge volumes. As a business, it’s crucial to make informed decisions that can only be achieved through accurate and practical data analysis, which may be a herculean task if trying to handle complex data manually. In this way, leveraging the power of AI for higher efficiency and productivity would allow your business to rapidly sort and analyse complex data, giving you accurate and relevant market insights in a fraction of the time.

AI can also be adopted to automate necessary enterprise operations and optimise performance, including regular internal administrative and operations roles. Businesses now use robots to update records and chatbots or virtual agents to communicate with clients using natural language processing and conversational AI technologies, enhancing public relations and customer satisfaction. Internally, generative AI has the potential to further boost your employees’ productivity through fast, unique and tailored content creation. Employees can now leverage generative AI to create professional, quality products in the blink of an eye (depending on your internet speed!)

That being said, we don’t recommend you suddenly go out and replace your workforce with robots and AI technology; the best attitude and ethical expectation is to employ AI technologies as a business enabler. Striking the right balance between artificial AND human intelligence will lead to greater business success than if you adopted one exclusively.

Threats to watch out for

Meanwhile, the emergence of AI technologies also introduces new challenges to the cyber security landscape, with significant implications, especially for privacy, peace, and security. As AI development becomes more exotic, threats are also becoming increasingly sophisticated and commonplace. After all, there are two sides to every coin; the more powerful AI technology is, the more dangerous and harmful it can be in the custody of cyber criminals. Gone are the days when hackers with deep technical knowledge were part of the select few who could execute a successful large-scale cybercrime. With the ongoing evolution of AI and the powerful AI technologies already available on the market, executing a successful cyber-attack is no longer the exclusive undertaking of a more technical hacker. Nowadays, anyone with basic technical know-how and access to AI has the power to wreak cyber havoc.

The average internet user is connected to the internet for 40% of their ‘awake time’, and the more time we spend online, the more exposed we are to cyber threats. In fact, cyberattacks are disturbingly common; if we look at the odds of a person experiencing a data breach for instance, the likelihood is a massive 25 percent! This is 240,000 times more than the odds of getting struck by lightning (1 in 960,000), or 55 times more likely than dating a millionaire (1 in 220). The stark reality is that falling victim to a cyber-attack is now a matter of when, not if. These attacks come in all shapes and sizes, but the most common currently being leveraged include social engineering, malware, identity compromise, scams, ransomware, and remote spying. A good adversary will leverage AI to attempt one or more of the above attacks, often simultaneously. A successful attack could potentially result in a hacker gaining unrestricted access and control of the whole network, compromising your system and exfiltrating your data.

There is also a risk involved in developing AI technology for specific business purposes. If not done with security in mind and with an adversarial mindset, attackers may get their hands on your AI model data, change configurations, and ‘teach’ the model inaccurate patterns to produce incorrect, malicious, or biased results. While this may seem unlikely, those seeking to gain a competitive edge may look to compromise AI technologies to achieve industrial sabotage, especially as organisations continue to adopt it.

Controls to Mitigate AI Risks

As with all major technology changes in recent decades, it’s doubtful that businesses will be able to afford or even resist implementing AI. However, it’s important that its use is governed, and the necessary controls and protective measures put in place to protect your AI assets from cyber threats or, if successfully attacked, to mitigate the effects of an incident.

These are ten of the top protective measures we recommend implementing when using AI:

1. Implement Access Control

Following the principle of Least Privilege, implement strong access controls to ensure only those who have a legitimate need, and the necessary privilege, can access your AI tools (and your critical infrastructure too!) Having Role-based Access Controls (RBAC) and a ‘need-to-know’ mentality is the best practice to reduce the risk of a data breach.

2. Segregate your Networks

From an infrastructure perspective, keeping any AI tools in a segmented network and away from your core infrastructure is critical. This way, even if your AI is compromised, your systems, and any sensitive data you hold, will stay safe and secure. Your AI tool can’t let the proverbial ‘cat out of the bag’ if it doesn’t hold sensitive information to begin with.

3. Update Software and Operating Systems

Install, update, and use antimalware software with an updated operating system on all devices. Antimalware software is a simple but effective protective measure to combat against the threat of malware, and can work against viruses, trojans, or ransomware that may be out to hinder your business operations. Continuously updating antimalware software will help to ensure that even the newest threats can be recognised and blocked.

4. Maintain a Strong Password Policy

Passwords are the first line of defence for your business; a weak password is all it takes for an adversary to gain unhindered access to your network system and critical assets. Adopting and enforcing a strong password policy to enhance your overall cyber security preparedness is in your organisation’s best interest. Using a secure and robust password or passphrase with multi-factor authentication (MFA) enabled will reduce the likelihood of such a breach.

NOTE: A longer password is better than a short and complex one; having at least 13 characters that are a mix of upper- and lower-case letters, numbers, and symbols makes it significantly trickier for cybercriminals to crack. Better still, using passphrases, something that is not easily guessable, and using a unique password for each account you have is the best practice. To avoid forgetting or losing your passwords, a trusted password manager can take care of this for you.

5. Encrypt Your Hard Drive

Encryption uses a specific algorithm to convert your critical data and information into unreadable code that can’t be easily deciphered without the key. Even if your security architecture is compromised, it will be very difficult for cybercriminals to access your data. In other words, data encryption gives you the peace of mind that even if you ARE compromised, your data remains safe.

6. Perform Regular Data Backups

Cultivate the habit of backing up your organisation’s data in a separate, secure location. When regular backups are kept, if there is a compromise, you have the ability to restore your systems to before the compromise occurred. Whilst this practice alone may not protect your data from getting into the wrong hands if breached, it guarantees that you will have access to your essential business data when you need it most. Having regular backups is the biggest way to combat the effects of a Ransomware attack, and gives you a leg up when it comes to business continuity.

7. Monitoring and Maintenance

Maintenance is important; ensure controls are effective, your AI tool performs as expected, and is delivering the service it was designed for. Make sure to monitor the performance of your AI tool, so that any potentially malicious changes in behaviour are detected and can be mitigated. Integrating your AI tools to your enterprise’s security solution will provide greater visibility and increase your response time. Like with most other technical solutions, a ‘set and forget’ mentality isn’t going to cut it when it comes to AI.

8. Use AI Responsibly and Ethically

By adhering to international best practices and standards, you can minimise your chances of experiencing a data breach. Your users should be guided by the principles of fairness, accountability, privacy, transparency, and balanced use when it comes to using AI. Your business should critically evaluate any AI tools before allowing them to be used to ensure that they are safe, that employees have a legitimate business need, and that using the tool will actually contribute to the business. A good way to achieve this is by developing a robust, but flexible AI Usage Policy for your business.

9. Do your Research

Mandating Business or Enterprise licenses for accepted AI, not ‘personal use’ ones, and examining the AI privacy conditions, reviews from other users, and the reputation of its manufacturer in the market, will all help to ensure that AI will add value. Remember – anything you submit to an AI tool becomes part of its database, so ensure that no intellectual property or sensitive data is entered. Even though you feed AI with your data, the ownership of the AI-generated content remains contested, especially for the AI tools in the public domain. Meanwhile, you may plan to engage a Third-Party to develop a specific AI technology for your enterprise; in that case, the contract’s terms should explicitly cover privacy, security, and ownership.

10. And finally… training!

Organising training for your users on your security efforts and communicating their responsibility and expectations around the safe use of AI is a critical success factor. With proper guidance, it will be easy for your users to use AI responsibly and align with your security posture. Engaging training, including gamification and workshops, will also provide an avenue for employees to ask questions and clarify any grey areas they struggle with.

AI has come to stay. To stay ahead of the curve, and get the most out of AI, businesses looking to adopt this technology need to position themselves to reap the benefits of AI and mitigate its threats by setting up barriers to fight cyber-attacks. RightSec specialises in providing top-notch cyber security services to businesses and organisations of all sizes, including advisory services related to governance, risks, and compliance. Contact us today to learn more about how we can help you protect your business and safeguard your reputation.