teissTalk: How AI can improve your security and compliance programmes

On 4 April, teissTalk host Tom Langford was joined by Dean Sapp, SVP, Information Security, Privacy, Risk and Compliance (DPO), Filevine; Jonathan Craven, Privacy and Compliance Lead, UK, iRhythm Technologies UK; and Herman Errico, Head of Security Program Management, Vanta.
 

Views on news

The US Department of the Treasury has warned of the cybersecurity risks posed by AI to the financial sector. The report, which was written at the direction of Presidential Executive Order 14110 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, also sets out a series of recommendations for financial institutions on how to mitigate such risks. The financial sector is reaching now an inflection point in the intensity of cyber threats it has to deal with – and the sooner the sector gets to grips with it, the better. AI can make threats more aggressive, more realistic and effective. Take the Hong Kong attack, where cyber criminals used AI to generate a scam online conferencing session with an employee’s supervisor and some high level executives to swindle the firm into wiring $25 million to the hackers. To fend these kinds of attacks off, you need to have protocols in place that will authenticate the identity of the caller via another channel. 

Mitigating the risks of AI deployments

If you train your AI on public sources, it will be more inaccurate and hallucinate more. Meanwhile, if you use large but verified data sets and high quality prompt engineering, you can have much more confidence in its accuracy. Because GenAI is so ubiquitous, it poses a problem similar to shadow IT. You must keep in mind that AI use is still in its infancy, though. Internal instances of AI are much safer but as soon as the company uses a public platform, it ends up in the wild west. There are also Ai models where you can turn down creativity to zero and it will give fact based results. 

But prior to any AI deployments, you must think of data governance. Strategies to mitigate cyber risks include adopting the NEST AI risk management framework or ISO 4001 to demonstrate that they use AI models responsibly. Deployment seems to be the easiest bit of adopting AI, the more difficult bits are data governance and ensuring the responsible use of AI. What makes compliance difficult is the fact that regulations keep being updated. What also makes it hard for businesses to navigate the landscape is that often times start-ups offering AI-supported services just say so on the tin but what they actually provide is not AI technology. There are certainly use cases though that call for the use of AI, such as extracting relevant information for a several thousand page long document. 

In the AI Act, there is a section that says organisations that are developing or delivering AI models should have the ability of human intervention if the AI doesn’t perform on pre-set parameters. Another requirement is the reviewing of the AI’s impact on various stakeholders – including the groups of people, for example, that appear in a video. There is also a data privacy law around automated profiling and decision making and the ability to explain what the company is using AI for, so customers can also be aware of what’s happening behind the scenes. Compliance frameworks are useful tools for organisations that don’t have strong familiarity with the technology to guide them through how to achieve compliance. 

AI can not only assist knowledge workers in different sectors but also making services more available and inclusive for everyone as a result of costs savings. Paradoxically, auditing complex AI systems can get so complicated that it can only be done by another AI. However, for each AI deployment, there must be guardrails and constraints put in place to ensure that the system won’t hallucinate or provide left field results. 

To remediate poisoning or corruption of your data sets, you must go back to the point right before the incident happened. 

The panel’s advice

• Have more than one method of approval whenever you carry out a high value and critical transaction (money, data, etc).
• Don’t get caught up in the AI band wagon.
• Don’t give in to FOMO when it comes to AI deployment. Before you embark on one, establish what you want AI to do for you and what value it should bring, while also inviting different functions to come up with their own use cases.
• Have honest conversations with colleagues about what AI they are using and support them where you can to avoid the shadow IT problem. Also, make them aware that if they use a public source, all the data they feed into it will become public too.
• Demonstrate strong data governance with ISO 42001.