Show notes
Show Notes: Markus Starke, an advisor for cybersecurity and digital process transformation, has recently been working in cybersecurity for the AI applications that corporations are using. Marcus explains that, AI plays a significant role in work, particularly in intelligent process automation. This concept involves combining technologies like robotic process automation, process mining solutions, chatbots, Optical Character Recognition, and more advanced forms of machine learning and generative AI to build end-to-end processes. However, cybersecurity issues can affect these automation systems, especially as more users use them individually. Safety Measures with AI Automation Markus talks about several dimensions of cybersecurity with AI automation. To ensure the safety of AI-related automation situations, clients are asked to review their setup from a Target Operating Model perspective. A framework is created to guide this process, including governance, secure development processes, and creating awareness about potential risks. Governance involves governing roles and responsibilities, access, user rights, and other aspects of the system. Secure development processes ensure that solutions only access the data they should access, store data securely, and use encryption. Securing the platform is another dimension, involving standard frameworks for cloud-based solutions. Awareness about the human factors in reducing risk levels is crucial for achieving good cybersecurity. And lastly, monitoring and reporting ensure that the environment is controlled to a degree. Examples of Cybersecurity Threats Using AI Tools Markus discusses cybersecurity threats with AI tools, such as generative AI (GPT) for working on company data. One example is a human user extracting data from their corporate data pool and sending out an email with this data, and sending it to their private email account, which could be used in a public chat GPT instance. This can be controlled by creating awareness and setting up standardized IT security control mechanisms to limit data extraction from corporate networks. Another example is using proprietary corporate data for advanced data analytics on GPT, which could expose it to a potential attacker. Private computers are typically less secure than corporate ones, making them more prone to being attacked or losing data to an attacker. Corporations generally want to limit the type of data that is made publicly available in generative AI applications. He states that it is not always clear what happens to the data that is input to AI applications. Markus also discusses the risks associated with using consumer versions of chat GPT, as any data uploaded could potentially be put into its training data. However, there are options for setting up AI applications in a limited way for specific corporate use cases, but it is important to evaluate these solutions on a case-by-case basis to ensure they fulfill specific needs and governance. With Gen AI, it is crucial to balance between limiting too much while maintaining control. AI Tools Retaining Data The discussion revolves around the use of AI tools, such as Zoom, which may be retaining data on calls or transcribing them without letting users know. This raises concerns about the accessibility of information to organizations. It is essential to ensure that these tools align with cybersecurity standards and are compliant with protection requirements. However, this may be a case-by-case consideration, and Markus emphasizes that it is always necessary to question security processes. In addition, he mentions that it is crucial for independent consultants to raise awareness about cybersecurity and AI. Basic rules apply to the use of AI, such as ensuring data is stored in controlled instances and using strong protection mechanisms like passwords, access rights, and encryption. When working with clients, it is important not to make their lives too simple by creating AI solutions for specific business problems. Cybersecurity can sometimes be perceived as slowing down businesses, but it is an essential control that must be maintained. Independent consultants should review these aspects and not make their work too easy. Markus strongly recommends that consultants should be aware of active and forthcoming regulations that apply to AI when setting up solutions for clients. Timestamps: 0:03 Cybersecurity risks in AI-powered process automation 03:10 Governance and security for AI-related automation 05:53 Cybersecurity risks with AI tools and data 10:48 AI data security and control 14:47 Cybersecurity and AI in business Links: Freelance Website: http://starkeconsulting.net/ Company Website: https://www.ten-4.de/ Unleashed is produced by Umbrex, which has a mission of connecting independent management consultants with one another, creating opportunities for members to meet, build relationships, and share lessons learned. Learn more at www.umbrex.com.