As AI tools become common at work, organizations need to decide how staff may use them and how company data is protected. This article is general guidance on three practices: governance, employee guidelines, and data loss prevention with monitoring. It is not a summary of a single talk or study; for a published framework, see NIST AI 600-1, the Generative AI profile of the AI Risk Management Framework.
Key Takeaways #
- Embrace AI with proper governance and monitoring.
- Establish clear guidelines for employee use of AI tools.
- Implement data loss prevention strategies tailored for AI.
The Rise of AI and Its Security Implications #
Employees use tools like ChatGPT and Google Gemini for many tasks. That adoption introduces security risks, particularly data leakage and exposure of sensitive information through prompts. Organizations need to adapt their cybersecurity strategies to these risks.
Governance: A Framework for AI Security #
To effectively manage the risks associated with AI, organizations should establish a governance framework that includes:
- Change-Control Policies: Implement policies that account for third-party data processors and integrate them into existing vendor assessment procedures.
- Usage Agreements Review: Regularly review API licenses and usage agreements to ensure alignment with business risks.
- Risk Assessment: Assess the risks from improper outputs, such as data leakage and model bias, and decide how outputs will be validated.
Employee Guidelines for AI Tool Usage #
As employees increasingly use publicly available AI tools, organizations must set clear guidelines to mitigate risks:
- Define Acceptable Use Cases: Clearly outline what constitutes acceptable use of AI tools within the organization.
- Educate Employees: Provide training on the risks associated with sharing proprietary information in AI prompts.
- Categorize Information: Develop categories for the types of information that can be included in AI prompts to promote safe experimentation.
Data Loss Prevention in the AI Era #
Data loss prevention (DLP) strategies must evolve to address the unique challenges posed by AI:
- Understand Data Aggregation Risks: Recognize that aggregated data can lead to unintended disclosures of sensitive information.
- Reassess Access Controls: Shift access control measures from traditional data management to a model usage context, ensuring that sensitive data is protected even when used in AI models.
- Develop New Protection Requirements: Collaborate with data owners to establish model-specific risk profiles and protection requirements.
Effective Monitoring Strategies #
Monitoring AI usage is crucial for maintaining security. Organizations should:
- Implement New Policies: Develop policies and procedures that extend secure application development to AI.
- Monitor Outputs: Create techniques for monitoring AI outputs to prevent unauthorized access to sensitive data.
- Ask Security Vendors: Ask your security vendors what their detection covers for traffic to and from AI tools.
Conclusion #
As AI changes how people work, organizations need to adapt their cybersecurity strategies. Governance, clear guidelines for AI tool usage, and data loss prevention aimed at AI give a practical starting point for protecting company data.
