The impact of new age tools on cybersecurity has been significant, transforming the way organizations protect their digital assets. Artificial intelligence, machine learning, and automation have provided cybersecurity professionals with powerful tools to detect, prevent, and respond to cyber threats in real-time. However, there are concerns about these tools being exploited by malicious actors. Preeti Singh, associate director- IT security Risk and Compliance at Osttra, recently discussed these implications with Dataquest.
Singh acknowledges the benefits of generative tools like ChatGPT in the cybersecurity industry. These tools can enhance the efficiency of cybersecurity staff, fill skill gaps within teams, and automate security incident analysis. They are capable of identifying and mitigating network security threats and filtering spam emails faster than humans.
However, Singh also highlights the potential risks associated with these tools. Hackers can exploit them to create sophisticated phishing emails and generate malicious code for hacking purposes. Existing vulnerabilities in these tools can lead to data breaches, and employees may unknowingly expose sensitive information in chatGPT, which saves messages on open AI servers.
To effectively adopt these technologies, the cybersecurity industry must consider both the advantages and disadvantages. Proper training, validation, and oversight of the tools are essential to mitigate associated risks. Singh emphasizes the importance of weighing the pros and cons and handling the implementation carefully for secure use of chatGPT and similar technologies in the security industry.
When it comes to overcoming these concerns, Singh suggests that CISOs and CIOs collaborate to address security and technology issues. CISOs act as a crucial brake, preventing information leakage and ensuring technology security. Risk assessments, access control measures, authentication, identity management controls, secure development practices, monitoring mechanisms, data privacy measures, regular system patching, user awareness programs, and incident response plans are some of the steps and actions necessary to protect against these concerns.
Singh also discusses how multinational organizations can navigate diverse cybersecurity and data protection regulations around the world. With more than 100 countries formulating data protection and privacy bills, companies face challenges in complying with these regulations. Singh recommends establishing a dedicated compliance team comprising experts from legal, IT security, and privacy fields to analyze applicable regulations and develop compliance frameworks. Implementing security controls, incident response plans, data classification policies, and procedures, and staying updated on emerging cybersecurity technologies are crucial in ensuring comprehensive compliance.
Lastly, Singh addresses the partnership between CISOs, CIOs, CEOs, and other board members in improving agility, responsiveness, and an organization’s security posture. CISOs and CIOs should simplify security concepts for business leaders and help them understand the importance of cybersecurity as a business need. They should align security initiatives with the business strategy and objectives and work closely with CEOs and board members to enhance security postures and governance frameworks.
By considering these practices and partnerships, organizations can navigate the complex landscape of data privacy regulations, improve their security posture, and safeguard their data and reputation.