Generative AI and the Future of Cybersecurity

Shane Barney, Chief Information Security Officer, USCIS

Shane Barney, Chief Information Security Officer, USCIS

Shane Barney, currently serving as the Chief Information Security officer at USCIS, plays a vital role in handling cybersecurity risks and strategies. Throughout his career, his expertise and understanding of emerging technologies and how they affect cybersecurity have been made very evident. He has been actively working on the issues raised by AI, to provide a digital ecosystem that is more stable and safe.

What are some of the challenges or trends that are currently impacting the cybersecurity landscape?

The emergence of genAI technology is probably one of the major issues that the cybersecurity landscape is dealing with. Even though, AI has long been a part of technology, new issues have emerged with the rise of genAI, particularly with large language models (LLMs). GenAI functions independently of established risk management frameworks, in contrast to traditional AI applications that do so.

The fact is, we are not prepared to handle the huge threats that genAI brings. For example, incidents such as data poisoning are difficult to respond appropriately because there are no established classification standards in place.

The core of the problem is our incapacity to correctly assess and manage risks related to genAI. We are faced with plenty of uncertainties in the absence of defined protocols and frameworks, specifically meant to address these difficulties.

How is the industry preparing to defend against potential breaches or, downsides from the emergence of genAI technology?

Security against potential risks and breaches is one of the many issues that arise from the usage of genAI technology in many industries. The government and industry have differing approaches to risk management, even though many enterprises are embracing this technology to expand and boost profitability. Divergent risk perceptions held by government agencies and private enterprises have sparked debates about whether AI models should be closed or open. Closed models restrict access to training data and models, whereas open models offer transparency through full disclosure of all AI system components.

“The private sector has relied on governmental frameworks to make decisions, but industry may increasingly take the lead in risk management.”

The necessity of collaboration between the private and public sectors in developing detailed procedures and regulations is brought to light by this ongoing discussion. Despite genAI solutions becoming more widely available, many suppliers are still having difficulty understanding this advanced technology. Security issues must be resolved quickly as unexpected circumstances may lead to strict laws that hamper the further development of AI in the future.

In what ways can AI algorithms be used as a proactive tool to detect and resolve vulnerabilities before their exploitation?

Being a CISO, system security is always my priority, but I also see how genAI may improve our security activities. We need to be aware that our enemies are utilizing genAI against us. To be prepared for it, we have to have our things in order.

Our company relies heavily on cloud infrastructure, therefore handling the huge amounts of data created presents significant challenges. GenAI functions as an additional layer of defense by being a valuable tool in locating and addressing vulnerabilities. Our investigation pertains to the potential deployment of an AI solution at the corporate level that is customized with security in mind. This platform would improve incident response, data management, and access control in addition to assisting in the identification and improvement; of vulnerabilities. We want to be ahead of emerging risks and make sure that our security infrastructure is strong, so using genAI as a proactive tool essentially fits with that goal.

What changes or improvements in the field of cybersecurity do you see emerging over the next twelve to eighteen months?

In the next twelve to eighteen months, I see a lot of progress made in the field of cybersecurity. First, to solve the issues raised by genAI, I see a stronger focus on coordination between both the private and public sectors. Building strong frameworks that put security, privacy, and civil rights first will rely on this relationship.

Second, I want to see genAI develop into a reliable technological stack free from the existing concerns about its application. It will take coordinated efforts from government organizations and industry players to do this, as well as to assure its responsible deployment and inspire confidence in its capabilities.