Some useful comments here from Northdoor on the tricky issue of deploying ever smarter AI tools;
Organisations should strengthen their security foundations before giving AI systems greater autonomy and access to business data, according to Northdoor plc.
The warning follows the publication of an open letter by OpenAI calling for urgent collective action on cyber defence. Signed by more than 100 organisations from the technology, cybersecurity, financial services and infrastructure sectors, the letter warns that AI-enabled cyberattacks are likely to become much more widespread as models become increasingly capable.
It calls on organisations to make cyber defence an immediate leadership priority and highlights longstanding weaknesses including excessive access permissions, unpatched software, poor authentication, misconfigurations and technical debt.
The letter also calls for greater support for the teams protecting critical infrastructure, including hospitals, water services and local government.
According to AJ Thompson, (above) Chief Commercial Officer at Northdoor plc, the technology industry is warning organisations that the threat landscape is about to become significantly more difficult to manage. However, he believes there is a certain irony in where the warning is coming from.
“There is a slightly surreal situation developing where AI companies are warning us that we need to bolt and padlock the stable door, while at the same time telling us they are about to open it,” said Thompson.
“The potential benefits of AI are enormous, but so is the potential for unintended consequences and for the technology to be used by cybercriminals.
“We are moving towards a world in which automated systems can act at machine speed, interact with several systems and potentially identify weaknesses much faster than a human attacker.
“Too many organisations still treat data security as a secondary consideration. Security is often revisited after an incident rather than being treated as a fundamental part of how the organisation operates.”
Thompson says even organisations that recognise the problem can struggle to put effective protection in place.
“Security technology can be expensive to acquire and complex to manage. The result is often a patchwork of tools that do not work together effectively, leaving already stretched IT teams trying to interpret an increasing number of risks and alerts.
“Adding more products does not necessarily make an organisation more secure. If the tools are not properly configured, monitored and managed, they can create more noise without giving the organisation a clearer view of its risk.”
Security foundations must come first
As organisations introduce AI into more business processes, Northdoor says they need a clear understanding of the data the technology will be able to access.
This includes knowing what data the organisation holds, where it is located, who can access it, whether access rights remain appropriate and how unusual activity will be identified.
AI systems may also interact with applications, cloud platforms and third-party services. This can increase the potential impact of excessive permissions, weak identity controls or poorly protected data.
Northdoor recommends that organisations review their data classification, access controls, identity management, monitoring and incident-response processes before extending the use of autonomous AI tools.
“There is no single product that can solve the security challenge,” Thompson continued.
“Organisations need a layered approach covering people, processes and technology. The starting point should be the data that matters most, the systems that can reach it and the identities that have permission to use it.
“AI may create extraordinary opportunities, but it is also increasing the speed and complexity of the threat landscape. The question is not simply whether organisations should use AI. It is whether their security foundations are strong enough for the environment they are moving into.”
Be the first to comment