AI, Cybersecurity, & Privacy Risks: A Navigational Guide

Published Date::20/09/2024

As AI adoption increases, new risks emerge that must be managed to realize its full potential. The NIST AI Risk Management Framework provides a foundation for addressing these risks.

The rapid proliferation of Artificial Intelligence (AI) promises significant value for industry, consumers, and broader society. However, as with many technologies, new risks from these advancements in AI must be managed to realize its full potential.

  The NIST AI Risk Management Framework (AI RMF) was developed to manage the benefits and risks to individuals, organizations, and society associated with AI. A key concern for those working in cybersecurity, privacy, and AI is how advancements in AI may impact current cybersecurity and privacy risks, risk management approaches, and how these risk management approaches relate to each other at the enterprise level.

  AI creates new re-identification risks, not only because of its analytic power across disparate datasets but also because of potential data leakage from model training. AI's predictive capabilities could also reveal greater insights about people as well as amplify behavioral tracking and surveillance. On the positive side, the analytic scope and broad reach of AI could be used to power personal privacy assistants that could help people better manage their privacy preferences across their online activities.

  AI will create new opportunities and challenges to cybersecurity, such as AI-enabled cyber threats, the use of AI to improve cybersecurity tools and capabilities, and ensuring AI systems are protected from traditional and emerging cybersecurity threats. Using AI for improving cybersecurity threat hunting, for example, could increase detection rates but might also increase the number of false positives.

  As business units across an organization incorporate AI technology in their solutions, there will be a need to better understand the dependencies on data across the organization. Those responsible for managing cybersecurity risks may need to reevaluate the relative importance of data assets, update data asset inventory, and account for new threats and risks.

  To meet the need for standards, guidelines, tools, and practices to improve the management of cybersecurity and privacy in the age of AI, NIST is establishing a program for the cybersecurity and privacy of AI and the use of AI for cybersecurity and privacy. The program will build on existing NIST expertise, research, and publications, such as the Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, Adversarial Machine Learning, and Enabling privacy in the age of AI.

  The program aims to understand how advancements in AI may affect cybersecurity and privacy risks, identify needed adaptations for existing frameworks and guidance, and fill gaps in existing resources. The program will work with stakeholders across industry, government, and academia and will play a leading role in U.S. and international efforts to secure the AI ecosystem.

  The program is kicking off a project to develop a community profile to adapt existing frameworks, starting with the Cybersecurity Framework, as well as understanding impacts to other frameworks such as the Privacy Framework, the AI Risk Management Framework, and NICE Framework. This effort builds on other community profiles developed for other use cases and technologies.

  The AI community profile will start with a focus on managing three sources of AI-related cybersecurity and privacy risks  cybersecurity and privacy risks that arise from the use of AI by organizations, determining how to defend against AI-enabled attacks, and assisting organizations in the use of AI with their cyber defense activities and using AI to improve privacy protections.

  We look forward to dialogue and collaboration on how to advance the program and help the cybersecurity and privacy community as they embrace the ubiquitous development and use of AI. Stay tuned and visit the new program website for more information. Please send any feedback or questions to AICyber [at] nist.gov.

FAQS:

Q: What is the NIST AI Risk Management Framework?

A: The NIST AI Risk Management Framework is a foundation for managing the benefits and risks to individuals, organizations, and society associated with AI.

Q: How does AI create new re-identification risks?

A: AI creates new re-identification risks through its analytic power across disparate datasets and potential data leakage from model training.

Q: What is the goal of the NIST program for the cybersecurity and privacy of AI?

A: The goal of the program is to understand how advancements in AI may affect cybersecurity and privacy risks, identify needed adaptations for existing frameworks and guidance, and fill gaps in existing resources.

Q: What is the AI community profile, and what is its focus?

A: The AI community profile is a project to adapt existing frameworks, starting with the Cybersecurity Framework, and its focus is on managing three sources of AI-related cybersecurity and privacy risks.

More Topics :