Surprisingly Useful AI Article Enhancements
It is now two years after the emergence of generative AI, and organisations that are still reducing the genAi security conundrum to a binary ‘ban or allow’ conversation may want to consider a more sophisticated approach. The latest report published by our Threat Labs and dedicated to Australia, shows that genAi is now used in 93% of Australian organisations. By now, both its risks and benefits are well documented, and a more mature approach should allow organisations to minimise the former, while maximising the latter, when simply allowing or banning genAi are both equally wrong options.
To ban or allow GenAi is a dilemma
There is no shortage of examples showing why allowing the widespread use of genAi across an organisation without any security guardrails presents inherent security risks. Perhaps the most notable one came early on, when Samsung employees leaked source code and sensitive information into ChatGPT on three different accounts, leading the company to ban its use entirely. Publicly reported incidents are the tip of the iceberg, and there has likely been a significant amount of similar, unreported data leaks since the advent of the technology.
But banning generative AI entirely may well be even worse. Not only does the organisation miss out on its productivity benefits, but it also exposes itself to insider threats. Responding to a survey from Gartner a large majority of employees said they would not hesitate to circumvent their company’s security policies to reach their business objectives. In the same spirit, they would likely find alternative ways to use genAi tools, probably outside of the organisation’s security perimeter.
Our own research shows that 6% of Australian workers violate their company’s data protection policy each month, with a fair proportion of those breaches being sensitive information and data uploaded in genAi prompts, including source code (46%), intellectual property (26%) and regulated data (18%).
Applying a modern security philosophy to genAi
There is a relatively new mantra among security leaders: safely enabling innovation. This is a major shift from the “Department of No” that used to prioritise security often to the detriment of innovation or the employee experience. Another piece of recent research we conducted among CISOs globally reflects this new mindset, with a majority of respondents stating that their risk appetite has increased in the last five years (57%), that they consider themselves to be business enablers (59%) and want to be even more so moving forward (67%).
The same philosophy of safe enablement, and striking a balance between empowering and securing should apply to genAi, and our research shows that Australian organisations are very much adopting the practices and tools to embrace it.
Block, coach and adjust
In place of a blanket ban, local organisations are blocking only the genAi apps that do not serve any legitimate business purpose, to the tune of 2.3 apps per month on average, and more than 50 in the most extreme cases. That requires measuring each app’s risk profile before making a decision, which will soon become tedious with the quick proliferation of genAi tools. But solutions exist to automate this measurement (perhaps ironically they draw heavily on AI and LLMs for their functionality) and establish ‘trust score’ to each app used within an organisation. Security policy for each app can be determined by this trust score.
A majority of companies (53%) are also adopting user coaching, which are real-time pop-ups alerting or blocking employees when they act in a risky way that does not comply with security policies, or are being exposed to malicious content. We can argue that the ability for annual cybersecurity training to drastically change behaviours is limited, with employees quickly forgetting a large portion of what they just learned. Discussing genAi in annual training is a first step, but for security best practices to stick, nothing beats coaching people on-the-go.
Real-time user coaching can cover all bases when coupled with Data Loss Prevention (DLP) tools, and also alert or block employees if they try to access, move or share sensitive data in a way that is not compliant. Which is why a large number of Australian organisations have implemented DLP tools with security policies specific to genAi apps (43%).
But for organisations to truly strike that balance between empowerment and security, they also need to build the ability to adjust those policies on-the-go, and for each team or even individual if necessary. While access to a genAi image generator may not be relevant for most of the staff, it may be for a team of designers. And if for whatever reason another team needs quick access to a blocked genAi tool to meet a tight deadline, security teams should be able to unlock this almost instantly. The ability to define and adjust policies dynamically and with granularity is what will ensure the adoption of such tools doesn’t create friction between security and the rest of the business.
For all the arguments listed in this article, I believe it is time for organisations to move on from the genAi ban conversation, and start considering more nuanced ways to get the best of both enablement and security.
Tony Burnside is VP and Head of APAC at Netskope.
Last Updated on December 13, 2024 by Tony Burnside
