Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
Navigating the Dualistic Waters of Generative AI in Cybersecurity
By Michael Rinehart, VP of AI at Securiti
As we venture into 2024, the landscape of cybersecurity is poised for a transformative upheaval driven by the rapid advancement of Generative AI. This technological marvel, while ushering in an era of innovation and productivity, also brings with it a dualistic nature of promise and peril. As such, 2024 stands as a critical juncture where the promise of Generative AI in cybersecurity must be carefully balanced against its potential to disrupt and endanger, calling for innovative solutions and regulatory frameworks to harness its power responsibly.
Generative AI will redefine the cybersecurity landscape, simultaneously promising innovation and peril
In 2024, the widespread adoption of Generative AI will be a double-edged sword for cybersecurity. While it promises significant productivity gains across various enterprise functions, the rush to embrace it will open organizations to substantial risks. Simultaneously, more restrictive regulatory frameworks and guidelines will emerge to ensure responsible adoption and compliance with data protection and security standards. In this context, enterprises that do not adopt safeguards in their adoption of Generative AI are likely to inadvertently expose company-sensitive information or customer data, leading to new kinds of data breaches and regulatory non-compliance.
Simultaneously, regulatory frameworks and guidelines will emerge to ensure responsible adoption and compliance with data protection and security standards. In 2024, cybersecurity efforts will be critical to reap the benefits of Generative AI while safeguarding sensitive information and maintaining regulatory compliance.
Cybersecurity will enter a new era as AI-powered attacks continue to democratize
Cybersecurity will confront evolving threats driven by Generative AI, primarily focusing on three critical aspects. The first may be the most obvious, but perhaps the most potent. Generative AI is proving particularly potent in generating very high-fidelity impersonation – text, image, and voice that will continue to make it increasingly difficult for victims to identify as fraudulent. Coupled with Generative AI lowering the barrier of entry ability to scale attacks, the odds of a successful breach can significantly increase.
Second, attackers will target the very benefit enterprises seek for Generative AI models – gaining insights into enterprise data. Whether through fine tuning or retrieval augmented generation, Generative AI models/systems are able to reproduce sensitive information and should be casually regarded as a data system with a natural language interface. Thus, a mismanaged deployment can break the original entitlements of the data. Attackers may be able to extract that data either through prompting or, if it is fine-tuned, by exfiltrating the model.
Finally, we will see cybercriminals use Generative AI as an attack vector itself. The hype around ChatGPT and Google Bard already sparked spoof apps and sites that harvest user information, but more sophisticated attacks using compromised open-source models have been demonstrated. For instance, it is now possible to poison a model to generate specific misinformation in response to a question. This is extensible to vulnerable source code generation and, possibly, to chat models capable of directing users of a site to unsafe actions.
As we navigate the evolution of AI threats, it will be critical for enterprises to implement innovative cybersecurity measures to effectively counter the risks.
The industry will pivot towards a specialized model safeguarding
In the new year, we will see a push for models with robust innate privacy and safety constraints, but we will find that this direction offers incomplete and inflexible protection. This is because such models cannot be adapted to new protections easily, and any fine-tuning can damage protections.
Instead, we will see a layered approach to security emerge, focusing on specialization through a two-tier strategy. Organizations will first adopt application-specific models, potentially augmented by knowledge bases, which are tailored to provide value in specific use cases, such as Q&A systems. Then, they will implement a monitoring system to safeguard these models by scrutinizing messages to and from them for privacy and security issues. Such monitoring will be more suitable as they can utilize models aligned with governance and data protection principles in addition to more flexible technologies. In essence, the year 2024 will witness a rapid adaptation of both traditional security and cutting-edge AI techniques toward safeguarding users and data in this emerging Generative AI era.
##
ABOUT THE AUTHOR
Michael is the VP of Artificial Intelligence at Securiti.ai. Prior, Michael was a chief scientist at Elastica/Blue Coat Systems leading the design and development of many of its data science technologies. He has deployed machine learning and data science systems to numerous domains, including Internet security, healthcare, power electronics, automotives, and marketing. Prior to joining Elastica, he led the research and development of a machine learning-based wireless communications jamming technology at BAE Systems. Michael has a BS from University of Maryland and a MS and PhD in Electrical Engineering from the Massachusetts Institute of Technology.
