The cybersecurity industry now has access to a new AI model called ChatGPT, which is open to the public for testing. Machine learning/artificial intelligence (ML/AI) for cybersecurity practitioners is relatively new, but with ChatGPT, cybersecurity professionals can see how it can be useful to their industry.
Possibilities for ML/AI in Cybersecurity
ML/AI can help amplify security efforts or reinforce a sound cybersecurity posture. One of the most common use cases for ML/AI has been endpoint detection and response (EDR), where ML/AI uses behavior analytics to pinpoint anomalous activities. It can use known good behavior to discern outliers, then identify and kill processes, lock accounts, trigger alerts and more.
ChatGPT for Automating Daily Tasks and Purple Teaming
ChatGPT can automate daily tasks for an overextended IT team. It can build the logic to identify and disable accounts that have not been active in the past 90 days. If a junior engineer can create and schedule this script in addition to learning how the logic works, then ChatGPT can help the senior engineers/administrators free up time for more advanced work.
ChatGPT can also be used for purple teaming or a collaboration of red and blue teams to test and improve an organization’s security posture. It can build simple examples of scripts a penetration tester might use or debug scripts that may not be working as expected.
The Limitations of AI
While AI has made great leaps in a short amount of time, it can still produce false positives that need to be identified by a human being. There are limitations to this usefulness, and by that, we are referring to complex human cognition coupled with real-world experiences that are often involved in decision-making. Unfortunately, we cannot program an AI tool to function like a human being, and we can only use it for support, to analyze data and produce output based on facts that we input.
AI is an important tool that security practitioners can use to alleviate repetitive and mundane tasks. While we’re witnessing the early days of AI technology, and even its creators appear to have a limited understanding of its power, we have barely scratched the surface of possibilities for how ChatGPT and other ML/AI models will transform cybersecurity practices. However, we must address the uneasiness it has generated. AI will not eliminate jobs in information technology or cybersecurity but will instead help cybersecurity professionals to improve their industry.
Leave a Reply