Cyber risks in a world of AI

• Downloading of applications that aren’t subject to the appropriate level of due diligence.
• Uploading business information and data into hosted AI engines where control is lost.
• Loss of effectiveness of existing controls e.g. Anti-Virus will be blind to these new processes.

1. Start with a policy that defines legitimate use and make sure it is published and understood.
2. Create a process to assess and approve/decline existing use cases.
3. Ensure local admin rights and AV settings prevent the download of applications to devices.
4. Toughen browser and AV settings to flag use of AI websites or websites with low trust scores.

• The development process will require you to experiment with different services and providers. This has an inherent risk as cybercriminals will move fast to insert malicious code into services (this is already happening).
• You are introducing a new supplier and processes into your supply chain and these need to be controlled.
• The attack surface of your organisation has changed and potentially grown. You need to ensure you design appropriate controls and security. 

1. A separate environment should be created for the development/experimentation process to reduce the risk of a malicious actor connecting to your business-as-usual network.
2. A due diligence process should be designed and carried out on new suppliers.
3. Existing policy needs to be updated to include the new technology and processes. For example, how are software patches identified and updated.
4. Your control framework needs to be updated. What controls, monitoring and alerts need to be created to secure the new business process.

• Spotting flaws in emails and websites has long been a protection against cybercrime. AI will enable greater sophistication. Social engineering can be taken to a new level as multiple approaches can be coordinated to entrap a victim.
• Impersonation is often a key part of attacks. Imagine deep fakes of images and voices, and think about what the criminals could do with that. 
• Speed of development will increase. Every time a control stops a malicious bit of code, AI will have the ability to instantly analyse and code a solution for the criminals.

1. Simulated attacks on staff need to be more frequent and mimic the new approaches.
2. Authentication and conditional access need to be improved to make the stealing of credentials ever more difficult for the criminals. 
3. Layers of defence will be essential. If a human gets duped, ensure that there is sufficient control and alerting to stop the progression of an attack.
4. Assessment and assurance will become increasingly important. Frequent assessment by experts will be required to keep you hardened against the increasing sophistication and scale of attack.