Using AI to play cat-and-mouse in cyberdefence

ARTIFICIAL intelligence (AI) is very much in the news. Recently, Japanese Prime Minister Fumio Kishida was surprised to hear a recording of his own voice produced by a deep fake program. A Japanese AI expert had trained the program for two hours to mimic the way Kishida sounds, including his tone and pitch of voice, the media reported.

This was just an experiment. But the possibility of a deep fake voice impersonating the Japanese prime minister, or any other world leader, is worrying.

Deep fakes are just one way hackers are using AI to gain access to networks, systems, and data. Other AI techniques, such as machine learning and natural language processing, enable hackers to find new vulnerabilities faster and more efficiently. AI quickly scans vast data and identifies patterns, enabling hackers to develop new ways of accessing confidential data that were once thought to be impossible or too difficult to access.

Hackers use AI to quickly crack passwords, break encryption methods, craft e-mails that appear to come from legitimate sources or launch distributed denial-of-service (DDoS) attacks. These cyber invasions can be automated to launch at a time of hackers’ choosing.

But AI is a double-edged sword. Cyber defenders too are leveraging AI to improve their ability, among other things, to predict attacks, track and trace hostile agents and take down cybercrime infrastructure. It is a cat-and-mouse game between the good guys and the hackers, each using similar AI tools to get ahead of each other.

AI in business is not a new concept. For many years, advanced militaries, and big companies such as Walmart, Amazon and Baidu have used AI to gain insights to improve their operations and businesses.

Over the years, continued research and development efforts have driven significant advancements in AI, shaping the landscape of today’s technology.

Recent years also saw greater focus on and development of deep learning, machine learning and big data techniques. What has changed is the availability of high-performance computers and an enormous volume of open-source data for model training.

In cyberdefence, AI tools can swiftly sieve through voluminous data to detect threats and automatically highlight anomalies in Internet traffic. For incident response, AI can identify quickly the digital “fingerprints” left behind by hostile agents. This aids human analysts to identify penetration points expeditiously.

In the generative AI space, the challenge is great but not hopeless. Generative AI combines content and context, enabling hackers to create new and never-before-seen fake scenarios. Disinformation can become more targeted and effective, and can be distributed quickly.

One suggestion is to establish a modus operandi for communicating with customers and partners. For example, videos and messages can be watermarked or embedded with an image to verify authenticity.

To respond effectively to the cat-and-mouse game between cyber defenders and attackers, chief information security officers (CISOs) have to grasp the three key factors currently influencing businesses – agile software development, the move to the cloud, and the emergence of remote/hybrid workforce.

Enterprises are adopting agile software development which enables them to innovate and constantly experiment with new features. This is a dynamic process that allows for quick iterations of a new application until a final solution is achieved.

The adoption of cloud computing enables enterprises to accelerate their business growth by eliminating the need to build on-premise infrastructure. This shift allows companies to bypass the time-consuming tasks of constructing their own IT infrastructure and re-engineering processes to align with the cloud. As a result, enterprises can prioritise innovation, and concentrate on expanding their business operations, as well as delivering exceptional services to their employees.

The emergence of the remote/hybrid workforce has disrupted the workspace. More crucially, workers working from home, cafes or anywhere else, may not have access to secure Internet connections, updated equipment and software, all of which expand the attack surface, making it attractive for hackers to exploit potential vulnerabilities and loopholes.

Each factor can create vulnerabilities in the system and network. Cyberdefence will be stepped up when security testing is embedded in the software development process, Internet pathways and points are secured, and employee equipment is updated with the latest cyber protective software.

AI++ can be a useful mouse trap 

For enterprises, the cat-and-mouse game has racked up their costs. According to insurer AIG, each data breach in 2022 cost enterprises an average of US$4.35 million to manage. Damages from loss of productivity, intellectual property and other harms suffered by enterprises due to cyberattacks could amount to about US$10.5 trillion by 2025, according to AIG.

AI can be leveraged in cyberdefence. However, to get the best out of it, machine learning, natural language processing and other AI tools have to be integrated into a defence strategy.

An appropriate combination of AI techniques is needed to protect enterprises. Technology must also be combined with good management practices if enterprises are to stay ahead in the cat-and-mouse game. I would keep the data crown jewels, like business process applications, intellectual property, identity and access management, and customer information under close observation to better detect anomalies.

Adopting a threat-informed defence strategy will ensure that an enterprise invests in the right capabilities to deal with threats that will do it the most harm, especially those that are dominant in the local country and region.

Lastly, I cannot emphasise enough the importance of enterprises measuring and quantifying security effectiveness. With agile development and continuous integration/continuous deployment (CI/CD), security testing can be automated and embedded into every stage of system development, deployment, and operations. The information collected will provide a feedback loop to improve cybersecurity.

Can the cat catch the mouse? Technology combined with good management practices will go a long way to ready the pursuer to pounce on the target.

The writer is head of research and development for Ensign Labs, Ensign InfoSecurity