How can businesses ensure their AI systems are secure?

Tip #1. AI security starts with discovery (visibility). Do you know what consumer AI apps are used by your employees? Do you understand what models your developers are using? Do you govern what corp data is being shared for training or inference? The former question will soon be answered by your CASB/SSE vendors. The latter will also be addressed by existing security tech stacks (CSPM, NDR/CDR, Data Governance/DSPM...)...In any case, discovery is first....

Don't build your AI street cred on a ChatGPT foundation. It might vanish like a ghost, leaving your product in a slump, Like a rapper who choked on stage and forgot his lyrics to the thump. ChatGPT could spill secrets, leak customer A's data to B, A privacy nightmare for users, a PR disaster for thee. So train your model with caution, avoid those customer details, Don't be a data-stealing bandit, or you'll face legal battles and wails. Anonymize like a pro, keep those identities masked, Don't let your AI become a data-leaking fiasco, a reputation unmasked. So ditch the cheap tricks, the shortcuts and the hype, Build with ethical AI, and let your product truly shine bright.

?? You should also consider the dynamic nature of risk assessment in AI. ?? Comprehensive Threat Modeling Identifying potential threats specific to AI, like adversarial attacks on machine learning models, is crucial for robust security. ??? Impact of Data Integrity The quality and integrity of training data are paramount, as they directly influence AI behavior and vulnerability. ?? Continuous Risk Evaluation The evolving landscape of AI necessitates regular reassessment of risks, ensuring that security measures stay effective over time. ?? Businesses must adopt a proactive and evolving approach to risk assessment for AI systems to maintain security.

A simple and obvious tip is not to use public versions of generative AI tools. For instance, in a joint effort with Microsoft and OpenAI, AT&T developed an employee tool similar to ChatGPT called Ask AT&T for coding software. AT&T ensured that data entered into Ask AT&T, including questions and responses, would not be shared with the public ChatGPT, enhancing security. Employees were given guidelines against using the public ChatGPT for work-related tasks.

Businesses can ensure the security of their AI systems by implementing robust cybersecurity measures. This includes regular vulnerability assessments and penetration testing, encryption of data at rest and in transit, access control policies, and monitoring for unusual behavior. They should also stay informed about the latest security threats and best practices to keep their AI systems up to date. Additionally, educating employees about cybersecurity and ensuring compliance with relevant regulations are crucial for safeguarding AI systems.

ML models are susceptible to different types of attacks that could lead to data leaks and model poisoning. Models fine-tuned on an organization's data - should be access controlled with the same or higher constraints as the data that was used to train it. Inputs and Outputs, Source of the request etc. should be logged and traceable.

AI systems comes with lot of capabilities towards observability, be it to improve its efficiency or performance. Same information can be used to design downstream rule based engines to identify anomalies but at smaller and case to case basis.

From monitoring perspective, businesses should have solid monitoring measures in place to monitor their AI systems' 1. inputs (prompts or queries, inference requests, etc): to detect adversarial inputs, enforce audit & compliance, and remediate compromise/misuse cases. 2. outputs (including performance): to observe behavioral changes affecting security, identify potential intrusions/compromises vs natural data drift.

For the human aspect of AI security, businesses should make comprehensive documentation available to promote transparency and accountability, and educate users about their AI systems' 1. configuration settings - so business benefits derived and any security risks introduced are clearly understood. Controls are in place to safeguard against improper or malicious usages. The most secure setting should be the only option and where configuration is warranted, common threats should be secure by default. 2. known limitations &/or potential failure modes - so users know how to use the system appropriately. 3. security aspects that users are responsible for, how their data may be used, accessed, shared and stored securely.

Ai solutions are no different from any other tech solution. In order to ensure they are secure the same security best practices should be applied: - Assessment (Vulnerability Scanning, Security Testing, etc); - Access control; - Data protection; - Education and training; - Monitoring; - Incident response and disaster recovery; - Auditing; - Vendor and 3th party security; - Software and system management(regular software/hardware upgrades/updates); Ai systems might pay additional attention on things like: - Data bias and fairness; - Privacy; - Explainability and Transparency; - Auditing and Logging; - Regulatory Compliance; - Model and Data security if applicable ( data encryption/minimizarion, model protection, model version control, et