With the global, regular use of generative artificial intelligence nearly doubling over the past year, rapid adoption has created a lucrative new target for cybercriminals, according to McKinsey. While ‘off the shelf’ solutions have made up a large part of this deployment, organizations that see the power of fine-tuned, business-specific responses have spent a large budget on training their own AI models.
Continuous innovations, such as agent AI, mean that adoption is only increasing. The significant autonomy that agent AI possesses allows it to make decisions, plan actions and learn from its experiences within a company’s specific context, making it applicable across business functions.
But amid the excitement surrounding AI, there are significant cybersecurity risks that are too often not considered. By introducing any new software solution, companies introduce a new attack vector for cybercriminals. The problem with proprietary AI models is that they are essentially a repository for a company’s most valuable data, from intellectual property, customer and employee data, and trade secrets, making it a highly attractive target.
This software runs on hardware likely housed in a data center, so business leaders need to ensure they are equipped with the right tools to control all aspects of their network to ensure sensitive business data is safe in the new attack vectors , they use.
CEO and co-founder of Goldilock.
The challenge to existing frameworks
The fact is that many companies’ existing security setups are currently not fit for purpose. For years, IT departments have viewed cybersecurity as a compliance hurdle rather than a way to protect corporate data. This has led to an over-reliance on perimeter defenses and single sign-on solutions, which can create a false sense of security for organizations that believe compliance equals security.
Software solutions and more traditional approaches to data security, such as firewalls, still have a place to protect a company’s data security, but a greater depth of defense is required to ensure operations run smoothly. Although AI is powerful, it is still a type of software that runs on hardware typically found in a data center. Data centers are complex and sensitive environments. Factors such as power requirements, cooling systems, and physical security make these facilities prime targets. Furthermore, the nature of AI development and implementation requires frequent access and updates. This requires strict control over who can access these systems and when. Organizations need to ensure they have the right frameworks in place to ensure their AI models run correctly and are protected at all operational levels.
Physical segmentation: establishing control and defense
Many will already have some of the necessary components in place. What the majority lack is a first and last layer of defense that can be established via physical network segmentation. Through a hardware-based approach, physical network segmentation enables users to segment all digital assets remotely, instantly and without using the Internet. Through the push of a button, from anywhere in the world, organizations can use this technology to physically isolate their chosen segment from the overall network and disconnect it from the Internet. This technology acts as a guardian of AI, controlling access and ensuring that its benefits can be reaped. For companies using artificial intelligence, it can offer the following benefits:
1. Improved security and reduced risk
In the context of protecting an AI model, this type of protection can act as a guardian, preventing a company’s own AI from being poisoned and preventing the use of AI for malicious purposes.
Without a connection to the Internet, physical network segmentation can be used to disrupt the model, preventing a cyber attack or unwanted access. This will hide assets and improve an organization’s existing defense depth. For AI models, network segmentation can be used to keep components offline until they are needed, massively reducing the time a hacker has to gain access to the software.
Organizations may be hesitant to adopt this approach, assuming it would cause disruption to operations. But this need not be the case. The key is to implement a process that establishes smart and considered timing. A generative AI model does not necessarily need to be connected to the Internet 24/7 to perform well. A connection is required for a short window when users send a prompt. Once sent, the model can be disconnected and reconnected when the response is generated and needs to be sent back. This short period is not nearly enough for a cybercriminal to clone the model and get their hands on sensitive company data. In terms of user experience, the time it takes to connect and reconnect should be short enough that humans won’t notice a delay.
2. Help comply with legislation
Governments worldwide are adapting to the sensitivity of data. With AI models holding such a range of sensitive data, all eyes are on companies to prove they are doing everything possible to prevent an attack or breach. With a lack of AI-specific regulation, it’s hard to know where to start. Physical network segmentation can support overall compliance because there is no better effort than keeping sensitive data completely off the Internet or physically separating it when attacked.
3. Effective incident response and recovery
In the event of a cyber attack, reactive network segmentation can be used to prevent attack propagation and quickly isolate compromised assets and data, effectively preventing further access by hackers. During the recovery process, managers will have the ability to then quickly restore previously isolated, known secure segments after an attack, enabling secure AI models to be deployed as quickly as possible and ensuring service recovery.
Looking ahead
With more and more AI models trained in-house, cybercriminals will more than likely start targeting these stores of sensitive data. Once they have access to the AI, all kinds of havoc can be caused by the ability to clone the data, poison the model to generate harmful responses, or lock it down with ransomware, causing significant business damage.
Organizations must be able to confidently harness the power of AI without compromising security. By implementing a framework that allows individual control of zones through network segmentation, business leaders will not only be able to mitigate threats, but also establish effective response and recovery processes while ensuring maximum performance across the enterprise.
We have created a comprehensive list of the best AI tools.
This article was produced as part of TechRadarPro’s Expert Insights channel, where we feature the best and brightest minds in the tech industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing, you can read more here:
