Generative artificial intelligence (A.I.) can feel overhyped at moments, but data suggests more enterprise workers are using it. A survey by security firm Cyberhaven, based on usage patterns of 3 million employees, shows the amount of corporate data added to A.I. platforms increased by 485 percent between March 2023 and March 2024.
The same data shows that the most popular generative A.I. tools in use come from the bigger players in the market (OpenAI, Google and Microsoft), although nearly two dozen startups and smaller firms are listed as offering alternatives.
Amid generative A.I.’s promise, however, is a lurking security problem that experts have now dubbed “shadow A.I.,” akin to previous cybersecurity issues associated with new technologies that begin creeping into enterprise networks and infrastructure. Previously, “shadow IT” and “shadow cloud” caused headaches for tech professionals trying to secure corporate data from escaping when business units or individual employees began experimenting with unsanctioned and untested versions of new tools.
The Cyberhaven report found that 73.8 percent of ChatGPT accounts currently deployed are non-corporate instances that lack the security and privacy controls of ChatGPT Enterprise. That percentage is higher for Google A.I. tools. The survey also noted: “In March 2024, 27.4 percent of corporate data employees put into AI tools was sensitive, up from 10.7 percent a year ago. The variety of this data has also grown.”
At the recent RSA Conference in San Francisco, CISOs and other cybersecurity leaders expressed concern that the same risks associated with shadow IT and cloud are re-manifesting themselves with generative A.I. It’s driving the need for more policies and corporate approval processes for how the technology is deployed and what data is approved for use in Large Language Models (LLMs) testing.
“Every few years, some hot new trend upends the tech stack and how we go about securing sensitive data and assets. Metaphorically, the livestock has escaped the barn, then the barn was burned down, and now the morning after we have to contend with untamable organic free-range IT,” noted John Bambenek, president at Bambenek Consulting.
For tech and security professionals charged with helping to bring generative A.I. into the enterprise, securing it, protecting data and creating policies, understanding shadow A.I. and its consequences is critical to developing new skills as the enterprise landscape changes to accommodate these modern tools and platforms.
Understanding the Shadow A.I. Risk
Since the release of OpenAI’s ChatGPT, cyber professionals and government agencies have warned about the risks inherent in generative A.I. platforms. The National Institute of Standards and Technology (NIST), for example, recently published a series of draft papers about A.I. risk, covering a range of topics from how cybercriminals can use the technology to deploy malware and phishing schemes to how threat actors can take advantage of these platforms to compromise sensitive information.
Other documents have warned about issues deploying A.I. platforms such as privacy attacks, whereby attackers gather private personal data or sensitive company information by exploiting weaknesses in A.I. models.
In February, a report published by security firm Group-IB found more than 225,000 instances containing compromised ChatGPT credentials for sale on the dark web, showing the damage unsecured versions of these can be to corporate infrastructure.
Whether called shadow A.I. or A.I. sprawl, the results are similar to what tech and security pros saw with BYOD or shadow cloud: When enterprises rapidly adopt new technologies without comprehensive governance and control, the risk to corporate data increases, said Eric Schwake, director of cybersecurity strategy at Salt Security.
“These issues share common threads such as the proliferation of shadow IT, increased attack surfaces, lack of visibility and resource strain,” Schwake told Dice. “However, A.I. sprawl is distinctive due to the unique characteristics of A.I. itself, including its complexity, data dependency and potential for autonomous decision-making, which presents distinct and urgent challenges compared to previous issues.”
Schwake also points out that the still-opaque nature of A.I. models make them challenging to interpret and potentially prone to biases or vulnerabilities. The extensive dependence on data raises significant concerns about privacy and misuse.
“The autonomous decision-making capabilities of A.I. can lead to unforeseen and potentially severe consequences,” Schwake added. “The main security implications include data breaches, discriminatory outcomes due to biased models, adversarial attacks manipulating A.I. systems and challenges complying with evolving regulations around A.I. use.”
Since generative A.I. is new and organizations are still attempting to understand its full use and potential, Stephen Kowski, field CTO at SlashNext Security, said that enterprises must rethink the types of tech and security pros they hire to address the risks these technologies pose to their infrastructure and data. The problems are multiplied when employees then use untested tools.
“These systems require specialized management skills and are prone to ethical and privacy risks,” Kowski told Dice. “The biggest security implications include an increased attack surface and heightened data breach risks, necessitating comprehensive A.I. governance to mitigate these threats effectively.”
As organizations continue to invest and experiment with generative A.I. tools, tech and security professionals must rethink how they approach their jobs and what skills they need to stay ahead. This also includes ensuring employees are trained to use A.I. responsibly and the consequences of deploying unauthorized platforms.
“To manage A.I. sprawl and ensure responsible A.I. adoption, security, and IT professionals need to focus on A.I. literacy, prompt engineering, data governance, security awareness and A.I. ethical principles,” Kowski added. “Establishing a clear A.I. governance framework, implementing technical controls, fostering a culture of responsible A.I. innovation and staying informed on A.I. trends are essential strategies to mitigate the risks and effectively harness A.I.’s power.”
Getting a Handle on GenAI
Conversations from the RSA Conference show that CISOs and security leaders are working to get a handle on shadow A.I. and A.I. sprawl to avoid some of the cybersecurity issues associated with past problems such as shadow cloud.
“A.I. sprawl is becoming a growing concern for many CISOs who are not only recognizing the potential risks but also taking proactive steps to address it. They are developing strategies to manage and govern A.I. deployments, demonstrating their commitment to staying ahead of this issue,” Kowski noted. “However, some organizations are already struggling with AI sprawl due to the decentralized nature of A.I. development, especially in research and development environments. It’s a race against time to establish effective governance before the problem becomes more widespread.”
Besides CISOs, IT and security teams must also respond. This includes knowing more about how the models work and the data science field is evolving, Bambenek added.
“Certainly, IT and security staff need to know a little about data science, however, the models and mechanisms aren’t the most interesting components of A.I. systems,” Bambenek told Dice. “Knowing a little bit about how A.I. does what it does and how and where it gets its data are important. Soon, we’ll have to contend with threat actors getting data en masse into GenAI systems and what that will mean for solutions going forward.”
For others like Narayana Pappu, CEO at Zendata, countering shadow A.I. is about understanding data flows. This includes knowing which employees or managers within an organization are accessing corporate data and how their teams are using it within LLMs. From there, tech and security pros can better understand the issue they are facing and how to educate the workforce to secure data.
“We are in the excitement and experimentation stage of a new technology adoption. Therefore, in the case of many digital-first companies, this is a widespread problem. If you remember the days when cloud was getting adopted and tools like Dropbox and Box came into place, then you will remember the data exposure and security concerns they caused,” Pappu told Dice.
“Employees, and prospective employees, need to understand data flow and context around data usage—not just what information they have, but also how it is being used—increased convergence and the importance of the collaboration between engineering, CISO and the chief data officer roles,” Pappu added.
This post was originally published on 3rd party site mentioned in the title of this site
