AI is Disrupting the Cyber Threat Landscape

Cybersecurity has become an increasingly top-of-mind issue for businesses of all sizes. As technology evolves and new threats emerge, staying on the cutting edge of data protection is vital to protect your company and assets.

At a panel discussion at Verizon headquarters in Basking Ridge yesterday, experts discussed the current threat landscape when it comes to cyber attacks, particularly when it comes to the continued adoption of artificial intelligence (AI) by businesses and threat actors alike. 

According to the Verizon 2023 Data Breach Investigations Report (DBIR), both small- and medium-sized businesses and large businesses have increasingly become similar to each other when it comes to their respective attack surfaces – or the number of all possible points, or attack vectors, where an unauthorized user can access a system and extract data. The discrepancy between business sizes now comes in the form of an organization’s ability to respond to threats due to the number of resources they can deploy in the event that they are attacked. 

“One of the things we need to understand is assessing AI governance and building a framework in terms of implementations,” said Sean Atkinson CISO at the Center for Internet Security. “There is a risk assessment that we need to be able to do appropriately to understand the use cases and what type of [AI] tools can be used in respect to our data.” 

When it comes to governance and restrictions on a business level, it is important for companies to understand the risks to determine what, if any, restrictions they put in place on employee use of AI platforms.

“If you have uploaded sales data, marketing materials, or strategies to [an AI platform like ChatGPT, for example] there is real potential for intellectual property being exposed,” said Chris Novak, director of the Verizon Threat Research Advisory Center.

While setting guidelines on the internal use of AI in the workplace is important, outside threat actors continue to push the envelope with regards to the possibilities of AI. 

“These threat actors can use AI for the development of more effective spear phishing emails and text messages, as well as use data to learn from past attacks both successful and unsuccessful,” said Krista Valenzuela, Cyber Threat Outreach and Partnerships New Jersey Cybersecurity and Communications Integration Cell (NJCCIC).

She added that from an offensive perspective, AI can be used to better identify systems and the components of systems to try to find holes that can be exploited. 

“Threat actors are utilizing AI in general and machine learning to better do their operations in the same way that we might be doing it on the defensive end,” Valenzuela said. 

“From a defensive perspective, at the state level, we have utilized machine learning algorithms to try to identify potentially malicious websites, for example,” she added. The ability to more easily identify these algorithmically generated websites takes pressure off of having to do so manually, as has had to be done in the past. 

Additionally, Atkinson highlighted the possibility to leverage machine learning to identify attack paths and patterns and, in turn, implement automated defensive responses.

“One of the things we need to identify is timing,” said Atkinson. “Timing is everything. If we can get more automation and improve that response time [to attacks], that is going to see greater success and improve our defensive capability.”

Something to consider is that implementing AI, as either an offensive or defensive tool when it comes to cyber attacks, does take a significant amount of resources. 

 “My thought is that the defense might actually have an advantage here because we can band together and commonly invest in [defense and protection] platforms,” said Novak. “There are technology vendors out there that see it as a revenue driver for them, so they are inclined to invest as well. I think that, aside from nation-states which do have the resources, your organized crime groups that are more loosely affiliated may have a higher hill to climb [to successfully utilize AI].”

To access more business news, visit NJB News Now.

Artificial Intelligence Use Prompts Concerns, Poll Finds

Comodo Announces Comodemia, an Industry-first Cybersecurity Research Service for Academia

Can an Accounting Firm Help with Cybersecurity?