AI-Powered Cyberattacks: Defend Your Business

Gavin Dodd, head of information security at Clarity, tells Emily Moore how advances in technology are affecting the cyber landscape

WHEN AI research and deployment company OpenAI publishes a letter saying, “we have a limited window to strengthen cyber defences”, there can be little doubt that the cyber landscape is evolving in a way which businesses cannot afford to ignore.

Indeed, as the head of information security at IT company Clarity explains, both artificial intelligence and expanding legislative requirements are shaping the environment in a way for which Channel Islands businesses need to be prepared.

“While cyber threats are not new, AI is reducing the time and specialist effort that attackers need to make,” said Gavin Dodd. “As well as stressing the need for businesses to act quickly to strengthen their defences, the letter from OpenAI warned that AI-enabled attacks are expected to become more widespread and sophisticated. This means that any longstanding weaknesses, such as unpatched software, excessive network access and weak sign-in methods leave organisations vulnerable to attack.”

But while AI may be accelerating the speed at which attackers can act, Gavin adds that it is not necessarily changing the nature of the threat.

“AI attacks often look quite normal,” he acknowledged. “They could take the form of emails referring to real suppliers, events or familiar business processes. They could be messages asking employees to open documents, approve a sign-in or change the payment details. In such cases, attackers often use AI to make the language seem more natural and personalised to the recipient. Quite often, the email comes from a genuine, but compromised, supplier account.

“Other forms of attack supported by AI include rogue phone calls from a bank’s ‘fraud department’, or a fraudulent customer or applicant using an AI-created identity during remote onboarding.”

With many attacks appearing genuine at first glance, Gavin stresses that it is not enough for businesses to warn staff to be vigilant.

“Businesses need clear payment checks, independent paybacks, strong sign-in controls, reporting routes and realistic training to reflect the convincing nature of modern fraud,” he added.

While this may sound daunting, businesses may find some consolation in the fact that many “basic principles” still apply.

“Most of the time, AI-facilitated attacks are familiar crimes carried out with better tools,” Gavin explained. “Therefore, businesses do not need to throw away everything they already know. Sound basics still work but the pace and consistency need to change. OpenAi’s letter stresses that maintaining the status quo is not good enough and that organisations need to fix the highest-risk weaknesses, verify that fixes work and raise the standard for technology, including AI-generated software, that they buy or deploy.”

And in further good news for businesses, Gavin points out that AI can also help the defenders.

“AI can help security teams review information, identify unusual activity, explain technical issues clearly and prioritise which weaknesses need attention first,” he said. “The opportunity for local businesses is to combine AI tools with the skills of a trusted service team to support the quick identification of important problems, fast action and clear evidence that risks are being managed.”

When it comes to identifying priorities, Gavin advises companies to start by “establishing what the business genuinely depends on”.

“Once you have identified key services, where client information is held, who has powerful access and which suppliers could interrupt operations, you need to identify the small number of weaknesses that could cause the greatest harm,” he said. “Cyber defence should be an immediate leadership priority, with leaders assigning responsibility and understanding the organisation’s most serious exposure, who owns each action and what the fallback is if a system cannot be updated immediately.”

For anyone unsure where to start with those steps, Gavin says that Cyber Essentials offers a “clear starting point for protecting an organisation against common internet-based attacks”.

“Cyber Essentials helps to move businesses from thinking they are secure into a structured review, which can then be enhanced by the technical audit offered by Cyber Essentials Plus. But this isn’t the end of the journey, particularly for regulated firms, operators of essential services and organisations with very sensitive data, as they may need broader governance, incident readiness, monitoring and supplier assurance.”

As Gavin points out, Jersey businesses classed as providers of essential services will also need to pay particular attention to the Island’s new cyber-security law, which came into effect last month.

“The law is intended to strengthen the resilience of the Island’s critical service suppliers,” he said, “and says that operators of essential services will have to use appropriate cyber-security controls and report significant incidents.

“Organisations which fall within the law include banks, health providers, transport providers, digital infrastructure and utility providers, and I would encourage organisations to establish whether they are in scope, identify gaps, confirm who would contact the Jersey Cyber Security Centre in the event of an incident and rehearse how they would gather reliable information during an incident.”

Importantly, says Gavin, it is not just organisations classed as operators of essential services which will be affected by the law.

“Essential services often depend on complex supply chains, specialist technology and systems that cannot easily be stopped for maintenance. Hospitals, water treatment plants and internet infrastructure are examples of services at risk,” he explained.

“For a Jersey operator, the fact that we ‘cannot patch this industrial system yet’ cannot be the end of the conversation. The organisation needs to understand the exposure, put alternative safeguards around it, verify that those safeguards work and agree a safe route to improvement. It also needs to know which suppliers would be involved if something went wrong.

“While AI-enabled attackers may work more quickly across known weaknesses, the legal and operational position is still that businesses need to reduce avoidable exposure, monitor the systems that matter, practise incident decisions and maintain clear reporting.”

These messages are further underscored by guidance from the financial regulators within the Channel Islands.

“The Jersey Financial Services Commission is clear that firms remain accountable for outcomes when using AI, just as they are when they use other technology,” added Gavin. “The guidance focuses on the principles of governance and accountability, cyber security, privacy and data quality, regulatory compliance, consumer protection and fair treatment, and transparency and explainability.

“Meanwhile, the Guernsey Financial Services Commission has taken a similar risk-based view. Its updated handbook addresses new and developing technologies, including AI, and requires firms to assess relevant risks and vulnerabilities before adopting such systems. It also looks at data governance, system testing, staff training, cyber security and the risks posed by deepfakes and synthetic identities.”

As well as having to comply with local regulation, businesses in the finance sector are likely to be subject to the Digital Operational Resilience Act.

“DORA is an EU regulation focused on the ability of financial services firms to withstand and recover from technology disruption,” explained Gavin. “A Channel Islands firm may be affected if it operates in the EU, provides regulated financial services to an EU entity, forms part of a group applying DORA standards or supplies technology services into that regulated chain.

“Even where DORA doesn’t apply directly, its expectations are influencing client and supplier questions, and firms may be asked to explain their technology risks, incident handling, testing, recovery arrangements and oversight of important technology providers.

“This is why supplier security is becoming so important, and good supplier assurance supports DORA-style resilience, GFSC governance and sensible business continuity. It also supports good incident preparation.”

Such preparation, Gavin adds, means ensuring that people know what to do when a crisis happens.

“Organisations should have a short contact list, clear authority to make decisions, a method for recording facts and a way to bring in its technology provider, legal advisers, insurer, communications team and regulators where appropriate,” he said. “The plan should cover realistic scenarios, and it should be tested, something which is reinforced by Jersey operator of essential services duties and DORA-style resilience expectations. A plan on a shelf is not enough.”

While this may sound overwhelming, Gavin says there are five key questions that businesses should ask to assess their position.

“What matters most to the business? What could realistically go wrong? Which weakness would cause the greatest harm? How would we know an incident was happening? And could we recover and explain our response?

“The answers to those questions will enable leaders to agree a small number of priority actions and verify each one. And don’t forget that this needs to be done quickly, as the central warning from governments and AI providers is that there is only a ‘limited window’ in which to strengthen our cyber defences.”