How should I as a Security Leader learn Gen AI - Initial Thoughts !

 

    Since the last two years we have been overwhelmed with the deluge of Gen AI based applications and use cases. ChatGPT in its first avatar brought AI to our homes and daily lives. While personally, most of us continue to use Gen AI for various tasks we are also finding our organisations also discussing, brainstorming and adopting Gen AI in various forms.   The usage of Gen AI has moved from generating content to answering queries, preparing detailed plan and doing large complex tasks. 

    When we are at home we do not tend to worry so much about the security implications of Gen AI as we tend to be cautious as well as our data sets are generally smaller and do not reveal so much.  However this is also does not hold true as most recently I saw LinkedIN deciding to use its users content to train its GenAI models. This was without an intimation or warning to users except in regions like EU which have stringent privacy laws.  After the initial euphoria, the usage of Gen AI has raised several issues. The key issues include 

  1. Privacy Issues - use and leakage of persona data 
  2. Ethical Issues - bias in answering queried 
  3. Security issues - leakage of confidential data while training data.
 These issues are compounded when Gen AI models are leveraged by organisations. Organisations need to be concerned of several of these issues when leveraging Gen AI. Here the role of the Security Leader is very important. Unlike the Legal and Privacy teams, security teams work closely with the technical Engg teams and can understand the technical aspects much better. This helps them to understand the nuances better and tailor their recommendations and guidelines to ensure security is present while ensuring efficiency and productivity is not hampered. 

 Here in this blog I am trying to raise the key questions a security leader should be raising or be concerned with to ensure security of Gen AI applications within an organisation. 

There are three key areas where a security leader should be focused on in respect to Gen AI 
  1.  Securing usage of Gen AI among employees 
  2. Securing applications build with Gen AI models either in house or commercial 
  3. Leveraging Gen AI for security use cases 
I am beginning to learn these aspects and will share more as I build my knowledge by taking various courses online and reading books and white papers. 

Please do share any good resources - Courses, books and white papers which can aid my learning. 

Comments

Post a Comment

Popular posts from this blog

API Security - A risk based approach for CISOs

       APIs or Application Programming Interfaces are the building blocks of modern applications. As the usage of APIs  and API traffic increases it is likely to be the major attack vector for hackers. APIs are utilised for a variety of purposes such as - share data with partners, customers, and other third parties. As per Akamai, 83 % of internet traffic is driven by APis. While APIs are a powerful enabler of digital transformation, they also present new security challenges. In fact, Gartner predicts that in 2023, API abuses will be the most frequent attack vector. To substantiate that prediction, OWASP has come out with a separate OWASP Top 10 for APIs in 2019. Also multiple organisations such as Coinbase and IRCTC have been affected by API security vulnerabilities in their applications.  To tackle this emerging attack vector, CISOs should understand the key risks associated with APIs. These include: Data Breaches or Data Leakages -  Risk of data le...
Read more

2024 Year Review and thoughts

  My review of 2024.  The year was a mixed bag with a overall positive outlook and a few hiccups. My ratings on key parameters  Health - Average  Family - Good  Professional - Good  Career - Good  Finances - Average  Health -  My health has been a mixed bag with several notable improvements and some setbacks. Exercise - I was able to regularly attend Gym and do strength training.  Due to improved leg strength I was able to run a 10 k run in Dec in a time of 67 mins . I was 40th out of 120 runners in the Veteran category which I am satisfied with keeping in mind the several issues I had been having at the start of the year.  Gut Health : My stomach and gut issues continued which led me to a take a nutritionist led meal plan. This has helped but I still continue to have gas and loose motions intermittently  and outside food does not suit me at all. The worry is that my weight has reduced from 68 Kg to 63 Kg in las...
Read more

Key Steps for Building an Effective Data Protection Program: From Analysing Business Needs to Ongoing Protection

Key Steps for Building an Effective Data Protection Program: From Analysing Business Needs to Ongoing Protection In today's world, data is often referred to as the new oil, given its immense value to organisations. Companies have access to vast amounts of data, from customer information to intellectual property and strategic plans.  Over the last decade cyber criminals have targeted organisations repeatedly related to multiple breaches. Some organisations like Uber have faced multiple breaches and even government organisations are not spared as we observed in the Snowden case where confidential data of US  govt was leaked online. Protecting this data has become essential, and having an effective data protection program is crucial to achieving this requirement.  In my role as a CISO for the last five years I have found data protection as the most complex initiative yet most closely related to business enablement. This can be related to protecting customer data to prevent c...
Read more