Home > Security and Compliance Blog > Cybersecurity Risk Management > How AI Is Being Used in Cybersecurity and Cybercrime [a Checklist]

How AI Is Being Used in Cybersecurity and Cybercrime [a Checklist]

by Patrick Spencer updated May 3, 2023 Cybersecurity Risk Management

Reading Time: 7 minutes

The rapidly evolving landscape of artificial intelligence (AI) technology puts immense pressure on businesses to incorporate AI advancements into their existing processes. The velocity of change unleashed with the release of ChatGPT late last year is creating profound generational changes and advancements (putting aside the ethical considerations for now).

Despite guardrails being built into ChatGPT to prevent bad actors from using it for malicious purposes, reports on its use to craft phishing emails, write malicious code, and more surfaced shortly after the announcement in November. For example, according to research by Blackberry, 51% of IT decision-makers believe there will be a successful cyberattack credited to ChatGPT within the year, and 95% believe governments have a responsibility to regulate advanced technologies like ChatGPT. At the same time, the potential to use AI for the good of the cyber universe is just as great. AI can automate tasks, shorten incident response times, detect cyberattacks faster, and streamline DevSecOps, to name just a few of the use cases.

Cybersecurity pioneer Richard Stiennon addressed these and other topics in a recent Kitecast episode. Stiennon is the Chief Research Analyst at IT-Harvest, a data-driven analyst firm and is a board member for various organizations.

6 Ways AI Bolsters Cybersecurity

Even before the transformative announcement of ChatGPT last November, AI was already a game-changer in the field of cybersecurity. Today, AI-enabled cybersecurity systems provide advanced capabilities such as automated threat detection and response, predictive analysis, and real-time monitoring. Now, with the release of ChatGPT and Google Bard, AI is being tapped by cybersecurity professionals for even greater enhancements and acceleration. Following are some of the more prominent ways in which AI is being used in the space of cybersecurity:

AI in Threat Detection

Traditional cybersecurity solutions, such as firewalls, antivirus, and intrusion detection systems (IDS), rely on predefined rules to detect and prevent cyberattacks. However, these systems are not effective against advanced threats that use complex attack techniques. AI-enabled cybersecurity solutions use machine-learning algorithms to analyze large datasets and identify patterns of suspicious activity. These algorithms can detect new and unknown threats by learning from previous attack patterns and behavior. AI-based threat detection systems can identify threats in real time and provide alerts to security analysts.

AI in Vulnerability Management

Vulnerability management is a critical aspect of cybersecurity. Identifying vulnerabilities in software and applications is essential to prevent attacks before they occur. AI-based vulnerability management solutions can automatically scan networks and identify vulnerabilities in real time. These solutions can also prioritize vulnerabilities based on their severity and provide recommendations for remediation. This reduces the workload for security analysts and ensures that critical vulnerabilities are addressed promptly.

AI in Incident Response

Incident response is the process of handling security incidents and mitigating their impact on the organization. AI-enabled incident response systems can automate the entire incident response process, from detection to remediation. These systems can identify the root cause of the incident and provide recommendations for remediation. They can also contain the incident by isolating affected systems and preventing further damage.

AI in User Behavior Analysis

User behavior analysis (UBA) is the process of monitoring user activity on networks and systems to detect insider threats. AI-based solutions can analyze large volumes of user data to identify abnormal behavior. These solutions can detect suspicious activities such as unauthorized access, data exfiltration, and account hijacking. AI-based solutions can also identify insider threats by analyzing patterns of user behavior over time, enhancing user authentication and access controls.

AI in Fraud Detection

AI-enabled cybersecurity solutions can also be used to detect and prevent fraud. Fraud detection involves analyzing large datasets to identify patterns of fraudulent activity. AI-based fraud detection systems can learn from previous cases and identify new patterns of fraud. These systems can also provide real-time alerts to prevent fraudulent activity.

AI in Sensitive Content Communications

Cybercriminals and rogue nation-states understand the value sensitive content—including personally identifiable information (PII) and protected health information (PHI), intellectual property (IP), financial documents, merger and acquisition activities and plans, marketing strategies and plans, and more—and target its different communication channels with malicious attacks. Their attacks employ various techniques, including man-in-the-middle attacks, credential theft, and advanced persistent threats, to gain access to sensitive content communications. AI-enabled anomaly detection analyzes content activities to pinpoint behavioral anomalies that reveal potential malicious activity.

7 Ways Cybercriminals and Rogue Nation-states Build AI Use Cases

While tools such as ChatGPT offer many benefits, they also pose several cybersecurity risks that must be addressed. AI, led by ChatGPT, might be the biggest threat to cybersecurity over anything that has arisen. Following are some of the most concerning ways in which AI can be leveraged maliciously.

Data Privacy Risks With AI

One of the most significant cybersecurity implications AI poses is related to data privacy. Since these tools learn from large datasets of text, they could potentially expose sensitive information about individuals or organizations if trained on confidential data. This highlights the importance of safeguarding data privacy and ensuring that AI models are only trained on appropriate data sources. To minimize the risk of data privacy breaches, businesses must ensure that sensitive content is properly secured. This includes implementing data encryption, access controls, and monitoring tools to prevent unauthorized access.

Social Engineering Risks of AI

Social engineering is a tactic used by cybercriminals to manipulate individuals into sharing sensitive information or performing an action that could compromise their security. Chatbots like ChatGPT are particularly vulnerable to social engineering attacks because they rely on natural language processing (NLP) to communicate with users. Cybercriminals could use social engineering tactics to trick ChatGPT into revealing sensitive information or performing an action that could compromise the system.

Phishing Risks of AI

Phishing remains the most common attack vector according to the 2023 Hybrid Security Trends Report by Netwrix. A significant indication of phishing attempts used to be the use of poor grammar or incorrect language. However, ChatGPT’s exceptional ability to generate human-like content could prove advantageous for cybercriminals looking to create convincing phishing emails. The use of ChatGPT or any other tool could significantly reduce the time and effort required to construct an incredible number of phishing emails, particularly for hackers who lack fluency in English.

Using AI for Vulnerability Hunting

The process of vulnerability hunting might involve threat actors who attempt to exploit ChatGPT’s debugging capability in order to locate loopholes in various applications and systems. Instead of poring over numerous lines of code, these individuals can easily prompt ChatGPT to unravel the code and find possible flaws, quickly developing attacks to exploit those vulnerabilities.

AI-enabled Malware Attack Risks

Another cybersecurity risk associated with AI tools is malware attacks. AI-powered malware can adapt its behavior to evade detection by traditional security measures and can also impersonate legitimate software to gain access to sensitive information. To prevent malware attacks, businesses require a security approach that uses layers of security. These dramatically reduce the risk of a vulnerability exploit and the severity of impact.

Automating Cyberattacks Using AI

AI language models like ChatGPT can also be used to automate cyberattacks, such as automated hacking or cracking passwords. This is a growing concern as AI models become more sophisticated and capable of automating complex tasks like these.

Compliance and Legal Issues With AI

AI tools may also pose compliance and legal issues for businesses. Depending on the data shared with the chatbots, businesses may be subject to regulations, such as the General Data Protection Regulation (GDPR), that require them to protect the privacy of their users. To comply with these regulations, businesses must implement robust security measures that protect user data and ensure that they are only collecting data that is necessary for their operations.

Minimizing the Cybersecurity Risks of AI Tools

In an effort to stay ahead of the competition, organizations are rushing to implement AI technologies such as ChatGPT, without fully interrogating the impact on their cybersecurity posture.

With the integration of AI into business processes, companies not only gather data from external sources but also from their internal processes. However, this poses potential security risks, as sensitive company information and intellectual property may be at risk. Organizations that use AI-enabled processes must establish a framework to ensure the security, privacy, and governance of their data. Applying the same principles and safeguards as they do for other business purposes is vital to avoid the potential dangers of AI.

Companies like Amazon, JPMorgan Chase, among many others have banned the use of ChatGTP by employees based on risk. We’ve even seen ChatGPT banned at the country level, with the Italian government recently banning the use of ChatGPT until its maker OpenAI addresses issues raised by Italy’s data protection authority.

It is the responsibility of organizations to maintain the integrity of any data processes that utilize AI and safeguard the data from data center outages or ransomware attacks. It is crucial to protect data produced by AI from falling into the wrong hands and ensure compliance with local regulations and laws.

The Future of AI in Cybersecurity

There is no doubt that as the use of AI in cybersecurity becomes more widespread, regulations are needed to ensure that AI-powered systems are used ethically and responsibly.

The regulation of AI in regards to cybersecurity is a complex issue that requires a multifaceted approach. While there is currently no comprehensive regulatory framework for AI in cybersecurity, several initiatives are underway to address the legal and ethical challenges posed by AI-powered systems.

AI Cybersecurity Regulation

One approach to regulating AI in cybersecurity is through industry standards and guidelines. Organizations such as the National Institute of Standards and Technology (NIST) have developed recommendations for transparency, accountability, and privacy. These guidelines can provide a framework for organizations to develop their own policies and procedures for the use of AI in cybersecurity.

Another approach to regulating AI in cybersecurity is through government regulation. Several countries have established regulatory bodies to oversee the development and use of AI, including its use in cybersecurity. For example, the European Union’s General Data Protection Regulation (GDPR) includes provisions for the use of AI in data processing.

How Kiteworks Can Help Thwart AI-enabled Cyberattacks

One way that Kiteworks can help with AI-enabled cyberattacks is through its advanced threat protection capabilities. The platform uses machine-learning algorithms to analyze user behavior and detect potential threats, such as phishing attacks or malware infections. This allows Kiteworks to detect and prevent attacks that may be too subtle or complex for traditional security measures to detect.

In addition, Kiteworks includes features such as data encryption, access controls, and audit trails, which can help protect against data breaches and demonstrate regulatory compliance. These security measures are essential for protecting against AI-enabled attacks, which may use advanced techniques such as social engineering or machine-learning algorithms to gain access to sensitive content.

Kiteworks supports multifactor authentication to ensure that only authorized users can access the network. This adds an extra layer of security to prevent cyberattacks where hackers attempt to steal user credentials.

Schedule a custom-tailored demo of Kiteworks to learn how Kiteworks is built to withstand AI-enabled cyberattacks today.

Additional Resources