{"id":32589,"date":"2024-01-11T12:54:07","date_gmt":"2024-01-11T12:54:07","guid":{"rendered":"https:\/\/www.intelligentcio.com\/apac\/?p=32589"},"modified":"2024-02-08T09:44:39","modified_gmt":"2024-02-08T09:44:39","slug":"ai-is-shaping-the-future-of-cybersecurity-heres-how-to-adopt-it-securely","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/apac\/2024\/01\/11\/ai-is-shaping-the-future-of-cybersecurity-heres-how-to-adopt-it-securely\/","title":{"rendered":"AI is shaping the future of cybersecurity: Here\u2019s how to adopt it securely"},"content":{"rendered":"\n

Mike Hanley, CSO and SVP of Engineering, GitHub, says used effectively, AI can help prevent vulnerabilities from being written in the first place – radically transforming the security experience.<\/em><\/strong><\/p>\n\n\n\n

Interest in AI among developers in Singapore is surging.<\/p>\n\n\n\n

In fact, our 2023 State of the Octoverse<\/em> report revealed that the country\u2019s developer community ranked tenth globally in terms of contributions to generative AI projects on GitHub.<\/p>\n\n\n\n

In addition to this, Singapore’s National AI Strategy 2.0 is helping to set the stage for success with plans to triple the number of AI practitioners in the country to 15,000 to support growing AI demand.<\/p>\n\n\n\n

Although this paints a positive picture, I\u2019m often asked: Where do I start with AI? Is it safe? How do I talk about risk with my stakeholders?<\/p>\n\n\n\n

While AI is helping developers code faster and be more productive, some leaders are concerned that it can introduce additional security and risk management headaches.<\/p>\n\n\n\n

But the cybersecurity industry is no stranger to emerging technologies and we must continue to embrace every tool at our disposal to secure the software ecosystem.<\/p>\n\n\n\n

Used effectively, AI can help prevent vulnerabilities from being written in the first place\u2014radically transforming the security experience.<\/p>\n\n\n\n

AI provides context for potential vulnerabilities and secure code suggestions from the start (though please still test AI-produced code). These capabilities enable developers to write more secure code in real time and finally realize the true promise of \u201cshift left.\u201d<\/p>\n\n\n\n

This is revolutionary. Traditionally, \u201cshift left\u201d typically meant getting security feedback after you\u2019ve brought your idea to code, but before deploying it to production.<\/p>\n\n\n\n

But with AI, security is truly built in, not bolted on. There\u2019s no further way to \u201cshift left\u201d than doing so in the very place where your developers are bringing their ideas to code, with their AI pair programmer helping them along the way. It\u2019s an exciting new era where generative AI will be on the front line of cyber defense.<\/p>\n\n\n\n

However, it\u2019s also important to note that, in the same way that AI won\u2019t replace developers, AI won\u2019t replace the need for security teams. We\u2019re not at Level 5 self-Driving just yet. We need to keep our hands on the wheel and work with our existing security controls, not abandon them.<\/p>\n\n\n\n

Some teams are already reaping major productivity benefits from AI, but other leaders are still concerned about its security risks and want to know how to create the right standards around AI tools.<\/p>\n\n\n\n

I want to share a few best practices organizations can leverage when looking to adopt a generative AI tool.<\/p>\n\n\n\n

These strategies will separate the organizations that thrive and the organizations that fall short in protecting their most valuable assets.<\/p>\n\n\n\n

While AI is a novel technology, it has more in common with other tools than not. You can start with the same security and risk frameworks for evaluating an AI tool that you would for any other tool you\u2019re looking to bring into your stack and customize them over time. Ask for data flow diagrams, external testing reports, and other information about the tool\u2019s security and maturity.<\/p>\n\n\n\n

Additionally, organizations should implement processes to help them identify and manage the risks associated with any new tool provided by an external vendor. New tools or services should be carefully reviewed by the procurement, legal, privacy and security teams – with a particular focus on what data will be used, how it will be used and how the data will be protected by the external vendor.<\/p>\n\n\n\n

The key thing to keep tabs on is how your data, or that of your customers, is managed.<\/p>\n\n\n\n

You need to know how the AI tool manages your data, where the data goes, how it\u2019s shared and if it\u2019s retained.<\/p>\n\n\n\n

Pay attention to whether the vendor uses customer data for training their AI models and understand what options are available to opt in or out of that data usage based on your needs.<\/p>\n\n\n\n

AI tools open up a whole new world of intellectual property (IP) questions and the legal landscape is still evolving.<\/p>\n\n\n\n

Consider the new tool\u2019s IP clauses and review the terms of the licensing agreement to understand what protections may be offered.<\/p>\n\n\n\n

Keep in mind that any time a developer uses code they didn\u2019t create they encounter this risk.<\/p>\n\n\n\n

Responsible organizations and developers employ code scanning policies and other review practices.<\/p>\n\n\n\n

Understanding the tool\u2019s track record is important. This ensures the AI product is reliable, effective, and aligns with your company\u2019s objectives.<\/p>\n\n\n\n

Look for successful use cases that demonstrate its effectiveness.<\/p>\n\n\n\n

Other things to look at include bias mitigation, user reviews, and ability for customization.<\/p>\n\n\n\n

We all know that third-party testing and audits are invaluable in gauging a technology\u2019s efficacy or security. Same story here – ask if the AI tool has gone through third-party testing.<\/p>\n\n\n\n

Choosing a tool that has been rigorously tested and audited will strengthen the security posture of your organization.<\/p>\n\n\n\n

When it comes to AI, you don\u2019t have to be \u201cthe department of no.\u201d<\/p>\n\n\n\n

By engaging in the above best practices, you can set guardrails and rules of engagement that will result in secure outcomes.<\/p>\n\n\n\n

Just like AI won\u2019t replace developers, it won\u2019t replace your need for security teams, but it will greatly enhance their work.<\/p>\n\n\n\n

There\u2019s no better way to \u201cshift left\u201d than by having an AI-assisted pair programmer right there in the IDE with your developers, helping them write safer and more secure code in real time. This will help you get to better security outcomes faster\u2014and, dare I say, will radically transform the next decade of security.<\/p>\n","protected":false},"excerpt":{"rendered":"

Mike Hanley, CSO and SVP of Engineering, GitHub, says used effectively, AI can help prevent vulnerabilities from being written in the first place – radically transforming the security experience. Interest in AI among developers in Singapore is surging. In fact, our 2023 State of the Octoverse report revealed that the country\u2019s developer community ranked tenth […]<\/p>\n","protected":false},"author":58,"featured_media":32590,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3559,1272,31,52,59,44,54],"tags":[1108,174,4452,2097,5597,5598,264,69],"class_list":["post-32589","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-intelligent-technologies-cybersecurity","category-expert-voice","category-intelligent-technologies","category-main-story-newsletter","category-south-east-asia","category-top-stories","category-used","tag-ai","tag-cybersecurity","tag-generative-ai","tag-github","tag-mike-hanley","tag-prevent-vulnerabilities","tag-security-2","tag-singapore"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/32589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=32589"}],"version-history":[{"count":6,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/32589\/revisions"}],"predecessor-version":[{"id":32865,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/32589\/revisions\/32865"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/32590"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=32589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=32589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=32589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}