We will start this relaunch with some great information coming from the upcoming book "AI & Third-Party Risk" (by Gregory Rasner and Maria Rasner) that will provide readers with guidance and use-cases on how to identify, assess, and manage AI risks from their vendors and partners.
This blog will start to reveal some of the tips and guidance from the book to readers. Let's begin!
AI is just a risk. But that's not entirely fair - it's a complex risk that many of us find hard to understand, and many of our businesses are jumping into its use without full knowledge. The risk isn't well understood. One of the best ways to understand a risk is to know what kinds of threats exist for it.
- Hallucinations: when a machine learning model produces outputs that are not based on the input data or factual information.
Risk Reduction: Add validations, regular audits for AI, ensure exposure is limited for prompt manipulation, and fine-tune models for intended goals.
- Data Privacy Risk: GenAI systems can unintentionally leak confidential information. This includes personal data, business secrets, or other sensitive inputs used during training.
Risk Reduction: Ensure an SDLC, security training for developers and operators, good cyber defenses, and solid governance models.
- Lack of Transparency and Explainability: AI systems must not be a 'black box' or be unable to be explained.
Risk Reduction: how the model works should be easy to read/understand, with good documentation, performance metrics, and explanations for outcomes and outputs.
- Adversarial Attack: AI systems can be used by bad actors for malicious intent or can produce malicious output. The types of attacks on AI are: Prompt Injection Attacks, Data Poisoning, Access Exploits, Insecure AI code, and AI worms.
Risk Reduction: Ensure an SDLC, security training for developers and operators, good cyber defenses, and solid governance models.
- Data Manipulation or Poisoning: Data can be altered to create false or misleading data.
Risk Reduction: SDLC, ensure data flows are documented.
- Bias: AI systems can perpetuate and even amplify existing societal biases present in their training data, and perpetuate bias in outputs
Risk Reduction: Use of diverse data, fairness-aware algorithms, regular bias audits, and an explainable AI.
- Shadow AI: Just like Shadow IT, there are people in your organization using AI without the company's knowledge.
Risk Reduction: Acceptable use must include AI use rules. Engage your finance and AP teams to identify people using corporate cards or POs to purchase.
- Scalability and Malfunctions: AI systems can fail due to bugs, data inconsistencies, or unforeseen interactions with their environment.
Risk Reduction: SDLC, governance, and solid capacity planning
AI risks are unique to AI, and so there needs to be a little education on those risks. Now you also understand how an organization can lower the risks of each, so you can ask your vendors using or selling AI products if they are doing these risk-reducing activities for their AI risk.
Next Episode: How to Assess AI Risk in a Vendor...
Next
Pick Your AI RMF
From Third Party Threat Hunting (TPTH™)
Put it to work
Vendor AI risk
The free BEACON™ class: 19 minutes on the six categories of vendor AI risk, with a real case to work through.
Take the free class →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →