The era of accelerated digital transformation has sparked conversations about the role of AI in securing our data and networks. While the discussion often centers around advanced generative AI tools like ChatGPT, the impact of AI on cybersecurity is far broader and more nuanced. As businesses navigate this evolving landscape, one question looms large: is AI a friend or foe in the realm of cybersecurity?

 

As AI technology matures, we’re forced to address challenging questions, such as whether mainstream use of the technology inadvertently facilitates the entry of novice cybercriminals into the hacking arena. With each stride in AI’s evolution, we must don our “hacker hats” to anticipate how this technology might be harnessed for malicious purposes.

 

Attempting to ban employee use of novel AI tools due to potential security risks may not be the most practical approach. Reflecting on the history of technology, early internet iterations were initially championed by government and for research purposes, with apprehension around the potential for commercialization. Yet, the inexorable march of progress led to the internet becoming an integral part of business operations. Similarly, attempting to block tools like ChatGPT in the long term may prove to be an insurmountable challenge. Therefore, a more sustainable strategy for companies is to incorporate AI into their cybersecurity strategies.

 

Let’s delve into the security implications of AI, weighing both its advantages and disadvantages.

 

AI for Cybersecurity Challenges

 

The data security landscape is increasingly complex, with factors like extensive cloud storage, the proliferation of personal and professional devices, and the unauthorized use of apps or services. Unfortunately, AI introduces an additional layer of complexity. Cyber threat actors often target emerging products like ChatGPT, sensing vulnerabilities during the learning curve.

 

Here are some ways in which hackers can exploit generative AI:

 

• Phishing Ploys: Generative AI tools can craft convincing phishing emails and messages, capitalizing on the “human element” that plays a role in 74% of data breaches. Educating employees to recognize phishing attacks is crucial.

 

• Identifying Vulnerabilities: AI, including ChatGPT, can effectively identify applications associated with specific technologies, potentially revealing network vulnerabilities and insights to threat actors.

 

• Malicious Code Generation: Although AI tools have ethical safeguards, hackers can manipulate them to create harmful code or replicate malware strains, as demonstrated by recent findings.

 

AI for Cybersecurity Defense

 

On the flip side, AI can and has been an asset in bolstering cybersecurity efforts.  Defenders have been using various forms of AI such as machine learning, neural networks and deep learning for many years.  In addition, many strategies employed by hackers can be reimagined for positive use by cybersecurity professionals.

 

• Anti-malware: The top Antivirus/antimalware systems have used machine learning and deep learning techniques for nearly a decade to automate the identification of viruses and malware significantly faster than a human analyst can.

 

• Phishing Training: AI can simulate phishing attacks to train employees in recognizing and responding to potential threats.

 

• Behavior Analysis: AI can establish baseline behaviors for users, applications, and systems, flagging anomalies that may signify cyber threats. This capability extends to analyzing caller behaviors in call centers to distinguish between legitimate and suspicious callers.

 

• Automated Incident Response: In the event of a data security incident, AI can expedite incident response by leveraging historical data to recommend appropriate actions. This reduces response times, minimizes human errors, and mitigates the impact of security breaches.

 

• Securing Cloud Environments: AI can continuously monitor cloud resources, identifying misconfigurations and unauthorized access attempts, leading to a more secure cloud infrastructure.

 

• MDR/EDR/XDR: These are solutions that take meta-data and events from computers and networks, use AI/machine learning and other algorithms to do to first pass to identify and filter 99.9% out and then pass the anomalous events/alerts/traffic to human analysts for final categorization and incident handling. This is a combination of several of the areas above.  Adding the human analysts at the top of the chain allows the best of both worlds.  Human analysts can identify things that are truly new which can then be fed back into the AI tools for additional training.

 

Balancing the scales between innovation and security is imperative. The level of AI adoption will vary from one company to another, influenced by industry, digital policies, cyber literacy, and other factors. Striving for a middle ground between excessive caution and unwavering trust in AI is a prudent approach.

 

Moreover, it’s not an all-or-nothing proposition. Companies can fine-tune their data security controls and implement restrictions to ensure that AI applications like ChatGPT do not access their most confidential data. By closely monitoring how hackers and security experts employ AI tools and recognizing common ground, companies can position themselves wisely for the future.

 

To sum up, the role of AI in cybersecurity transcends the debate about any one specific tool or technology. It’s a dynamic landscape where businesses must navigate the complexities while harnessing the potential of AI to bolster their cybersecurity posture. As AI continues to evolve, embracing it as a valuable ally in data protection is the way forward, helping businesses protect their digital assets effectively and avoid sleepless nights over potential threats. Contact Velocity for a conversation about your cyber security needs and support to stay ahead of the technology curve.